TrojanDownloader:Java/Agent.S

Guidance for enterprise users

Apply these mitigations to reduce the impact of this threat. Check the recommendations card for the deployment status of monitored mitigations.

Vulnerability-specific mitigations

• Update all Log4j2 deployments to use log4j-2.17.0 and apply the security updates for CVE-2021-44228. Upgrade all products, applications and components that consume Log4j2. Apply all security updates for Log4J listed in this advisory.
• In case the Log4j vulnerable component cannot be updated, configure the parameter log4j2.formatMsgNoLookups to be set to ‘true’ when starting the Java Virtual Machine.
• All systems, including those that are not customer facing, are potentially vulnerable to this exploit, so backend systems and microservices should also be upgraded. For Apache Maven or Gradle projects, update Log4j to 2.17.0 on the dependency tree of the project.

General hardening mitigations that might help detect exploitation and post-exploitation activities

• Run the latest version of your operating systems and applications. Turn on automatic updates or deploy the latest security updates as soon as they become available.
• Use a supported platform, such as Windows 10, to take advantage of regular security updates.
• Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block majority of new and unknown variants.
• Run EDR in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus doesn’t detect the threat or when Microsoft Defender Antivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach. 
• Enable investigation and remediation in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume. 
• Use device discovery to increase your visibility into your network by finding unmanaged devices on your network and onboarding them to Microsoft Defender for Endpoint.
• Turn on the following attack surface reduction rule to block or audit activity associated with this threat:
• Block executable files from running unless they meet a prevalence, age, or trusted list criterion