Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Azure WAF matching for Log4j vuln(CVE-2021-44228)

This query will alert on a positive pattern match by Azure WAF for CVE-2021-44228 log4j vulnerability exploitation attempt. If possible, it then decodes the malicious command for further analysis. Reference: https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/

ATT&CK coverage

Outside the enterprise matrix

T1190Exploit Public-Facing Application 342 detections cover this technique

Detection requirements

Log source product: waf
Log source service: azurediagnostics

What the source says

Tagged by the source as

InitialAccess

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.