There may be earlier exploitation, but “find / -mtime -4” is a good way to look for weekend #log4j carnage on your Linux servers. RCE is likely unprivileged, so focus first on [/var]/tmp, /dev/shm, and similar world-write directories.

Dec 13, 2021 · 9:39 AM UTC

2
45
102
Replying to @hal_pomeranz @strandjs
doesn’t that cover only the last 4 hours? Just making sure I understand the command correctly. Maybe you wanted to write -48? Sorry if that question is silly.
1
The units for "-mtime" etc are in days
3
Replying to @hal_pomeranz
Except eBPF and auditD aren't xonfigured to monitor thos directories :P