Log4Shell-Linked Malicious Domains Behind CDN Infrastructure: OTX Pulse Analysis of Shared-IP C2 & Precision Blocking — Enterprise Detection Pack

---
title: Log4Shell JNDI Exploitation Attempt in Logs or Command Line
id: 9e4f2c1a-7b3d-4e5f-9a01-l4s000000001
status: experimental
description: Detects JNDI lookup patterns associated with CVE-2021-44228 (Log4Shell) exploitation in process command lines, matching the exploit-link activity flagged in the OTX pulse involving moonlighthathel[.]org and ukankingwithea[.]com.
author: Security Arsenal Threat Intelligence
references:
    - https://www.splunk.com/en_us/blog/security/conf26-agentic-soc-scalpel.html
date: 2026/10/13
logsource:
    category: process_creation
    product: windows
detection:
    selection_jndi:
        CommandLine|contains:
            - '${jndi:ldap://'
            - '${jndi:rmi://'
            - '${jndi:dns://'
            - '${jndi:iiop://'
            - '${jndi:corba://'
            - '${jndi:nis://'
            - '${jndi:nds://'
    selection_obfuscation:
        CommandLine|contains:
            - '${${lower:j}ndi'
            - '${${upper:j}ndi'
            - '${${env:'
    condition: 1 of selection_*
falsepositives:
    - Vulnerability scanners and authorized penetration testing
level: critical
tags:
    - attack.exploitation
    - attack.t1190
    - cve.2021.44228
---
title: Java Process Spawning Suspicious Child Process (Post-Log4Shell Execution)
id: 9e4f2c1a-7b3d-4e5f-9a01-l4s000000002
status: experimental
description: Detects Java/Tomcat application server processes spawning shells or living-off-the-land binaries, a high-fidelity indicator of successful Log4Shell exploitation leading to code execution and C2 staging.
author: Security Arsenal Threat Intelligence
date: 2026/10/13
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\java.exe'
            - '\javaw.exe'
            - '\tomcat.exe'
            - '\tomcat8.exe'
            - '\tomcat9.exe'
            - '\wlsvc.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\curl.exe'
            - '\wget.exe'
            - '\whoami.exe'
            - '\net.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate Java management tooling and build pipelines; tune per environment
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.t1190
---
title: DNS Query or Connection to Flagged Campaign Domains Behind CDN IP Space
id: 9e4f2c1a-7b3d-4e5f-9a01-l4s000000003
status: experimental
description: Detects DNS resolution or network connections to the malicious domains moonlighthathel[.]org and ukankingwithea[.]com identified in the OTX pulse, including connections to the shared CloudFront edge IP 13.226.251.40 when correlated with suspicious context.
author: Security Arsenal Threat Intelligence
date: 2026/10/13
logsource:
    category: dns
detection:
    selection_domain:
        query|contains:
            - 'moonlighthathel.org'
            - 'ukankingwithea.com'
    condition: selection_domain
falsepositives:
    - Threat intelligence validation and sandbox detonation
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1090

// Hunt: Log4Shell exposure + connections to flagged campaign domains / shared CDN IP
// Microsoft Sentinel — 30-day retro hunt

let maliciousDomains = dynamic(["moonlighthathel.org", "ukankingwithea.com"]);
let flaggedCdnIp = "13.226.251.40";

// Stage 1: DNS resolution of malicious domains
let dnsHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (maliciousDomains)
| project DnsTime=TimeGenerated, DeviceName, DnsRemoteUrl=RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine;

// Stage 2: Direct connections to the shared CloudFront IP
let cdnHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP == flaggedCdnIp
| project CdnTime=TimeGenerated, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine, LocalPort, RemotePort;

// Stage 3: JNDI pattern in process command lines (Log4Shell delivery)
let jndiHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where ProcessCommandLine has_any ("${jndi:ldap", "${jndi:rmi", "${jndi:dns", "${${lower:j}", "${${upper:j}")
| project JndiTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName;

// Stage 4: Java spawning shells/LOLBins (post-exploitation)
let javaSpawnHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName has_any ("java.exe", "javaw.exe", "tomcat")
| where FileName has_any ("cmd.exe", "powershell.exe", "certutil.exe", "bitsadmin.exe", "mshta.exe", "rundll32.exe", "curl.exe", "whoami.exe", "net.exe")
| project SpawnTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;

// Correlate all stages by device
dnsHits
| join kind=fullouter cdnHits on DeviceName
| join kind=fullouter jndiHits on DeviceName
| join kind=fullouter javaSpawnHits on DeviceName
| project DeviceName,
    DnsHitTime=DnsTime, DnsDomain=DnsRemoteUrl,
    CdnConnTime=CdnTime, CdnRemoteUrl=RemoteUrl,
    JndiCmd=ProcessCommandLine,
    JavaSpawnedProc=FileName, JavaSpawnTime=SpawnTime
| summarize arg_min(coalesce(DnsHitTime, CdnConnTime, JndiTime, JavaSpawnTime), *) by DeviceName
| sort by coalesce(DnsHitTime, CdnConnTime, JndiTime, JavaSpawnTime) asc

# Security Arsenal — OTX Pulse IOC Hunt Script
# Targets: moonlighthathel[.]org / ukankingwithea[.]com C2 artifacts + Log4Shell (CVE-2021-44228) exposure
# Run elevated. Output written to $env:TEMP\OTX_Hunt_Results.csv

$results = @()

# --- 1. DNS cache check for flagged malicious domains ---
Write-Host "[*] Checking DNS cache for malicious campaign domains..." -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $_.Entry -match "moonlighthathel\.org|ukankingwithea\.com"
}
foreach ($entry in $dnsCache) {
    $results += [PSCustomObject]@{
        Category = "DNS-Cache-Hit"
        Detail   = "$($entry.Entry) -> $($entry.Data)"
        Severity = "CRITICAL"
    }
}

# --- 2. Active/recent network connections to the shared CloudFront IP ---
Write-Host "[*] Checking network connections to flagged CDN IP 13.226.251.40..." -ForegroundColor Cyan
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {
    $_.RemoteAddress -eq "13.226.251.40"
}
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    $results += [PSCustomObject]@{
        Category = "CDN-IP-Connection"
        Detail   = "PID $($c.OwningProcess) ($($proc.ProcessName)) -> $($c.RemoteAddress):$($c.RemotePort) [$($c.State)]"
        Severity = "HIGH (requires SNI/domain correlation - shared CDN IP)"
    }
}

# --- 3. Java processes with suspicious child processes (post-exploitation) ---
Write-Host "[*] Enumerating Java processes and child processes..." -ForegroundColor Cyan
$javaProcs = Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object {
    $_.Name -match "^(java|javaw|tomcat)"
}
$suspiciousChildren = @("cmd.exe","powershell.exe","pwsh.exe","certutil.exe","bitsadmin.exe","mshta.exe","rundll32.exe","regsvr32.exe","curl.exe","wget.exe","net.exe","whoami.exe")
foreach ($jp in $javaProcs) {
    $children = Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object {
        $_.ParentProcessId -eq $jp.ProcessId -and $suspiciousChildren -contains $_.Name
    }
    foreach ($child in $children) {
        $results += [PSCustomObject]@{
            Category = "Java-Suspicious-Child"
            Detail   = "$($jp.Name) (PID $($jp.ProcessId)) spawned $($child.Name) (PID $($child.ProcessId)): $($child.CommandLine)"
            Severity = "CRITICAL"
        }
    }
}

# --- 4. Log4j vulnerable JAR sweep (JndiLookup presence in common app dirs) ---
Write-Host "[*] Sweeping for vulnerable log4j-core JARs (this may take time)..." -ForegroundColor Cyan
$searchPaths = @("C:\Program Files", "C:\Program Files (x86)", "C:\opt", "C:\tomcat", "C:\webapps")
foreach ($path in $searchPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -Filter "log4j-core-2.*.jar" -ErrorAction SilentlyContinue | ForEach-Object {
            if ($_.Name -match "log4j-core-2\.(0|1[0-4])(\.|-)" -and $_.Name -notmatch "2\.(1[5-9]|[2-9][0-9])") {
                $results += [PSCustomObject]@{
                    Category = "Vulnerable-Log4j-JAR"
                    Detail   = "$($_.FullName) — potentially vulnerable to CVE-2021-44228"
                    Severity = "HIGH"
                }
            }
        }
    }
}

# --- 5. Persistence artifact checks (common post-exploitation footholds) ---
Write-Host "[*] Checking persistence locations..." -ForegroundColor Cyan
$runKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        $values = Get-ItemProperty -Path $key -ErrorAction SilentlyContinue
        $values.PSObject.Properties | Where-Object {
            $_.Value -match "java|javaw|\.jar|temp|appdata" -and $_.Name -notmatch "^(PSPath|PSParentPath|PSChildName|PSDrive|PSProvider)"
        } | ForEach-Object {
            $results += [PSCustomObject]@{
                Category = "Suspicious-Run-Key"
                Detail   = "$key :: $($_.Name) = $($_.Value)"
                Severity = "MEDIUM"
            }
        }
    }
}

$recentTasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match "java|javaw|powershell|cmd" -and
    $_.Date -gt (Get-Date).AddDays(-14)
}
foreach ($t in $recentTasks) {
    $results += [PSCustomObject]@{
        Category = "Recent-Suspicious-Task"
        Detail   = "$($t.TaskName) -> $($t.Actions.Execute) $($t.Actions.Arguments)"
        Severity = "MEDIUM"
    }
}

# --- Output ---
if ($results.Count -gt 0) {
    $results | Sort-Object Severity | Format-Table -AutoSize -Wrap
    $results | Export-Csv -Path "$env:TEMP\OTX_Hunt_Results.csv" -NoTypeInformation
    Write-Host "`n[!] $($results.Count) findings written to $env:TEMP\OTX_Hunt_Results.csv" -ForegroundColor Red
} else {
    Write-Host "`n[+] No indicators found on this host." -ForegroundColor Green
}