rules.txt

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Log4j LDAP searchResEntry response with javaSerializedData - JNDI-Exploit-Kit"; flow:to_client,established; content:"|30|"; depth:1; content:"|64|"; within:8; content:"javaSerializedData"; content: "javaCodeBase"; content: "http"; within:8; content:"javaClassName"; sid:21122001; rev:2;  priority:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Log4j LDAP response with JNDIExploit framework attributes"; flow:to_client,established; content:"|30|"; depth:1; content:"|64|"; within:8; content:"javaClassName"; content:"javaCodeBase"; content:"http"; within:8; content:"objectClass"; content:"javaFactory";  sid:21122002; rev:2; priority:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Log4j LDAP searchResEntry response with javaSerializedData - JNDIExploit"; flow:to_client,established; content:"|30|"; depth:1; content:"|64|"; within:8; content: "javaClassName"; content:"javaSerializedData"; sid:21122003; rev:2; priority:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Log4J RMI ReturnData with Java Serialized Object"; flow:to_client,established; content:"|51 ac ed 00 05|"; depth:5; sid:21122004; rev:2; priority:1;)