attack logs on log4j

WIZARD SPIDER Targets Financial Institutions

A hidden shell command is launch from a running svchost.exe process on a Windows domain controller.

wmic process where name="svchost.exe" get 

processid,name,commandline,sessionid,creationdate

tasklist /v

Monitor unusual behavior from svchost.exe instances, in particular 

the presence of suspicious DLLs leveraging svchost.exe to make unusual network connections to external infrastructure.