Record 08ef69ab3168fd2587bb83fd · v1
Schema CheckedNot runtime validated
Alerts related to Log4j vulnerability
Source repository hunting query
Generation sourcesource-file · Limited verification
Attributionmicrosoft
Last updated12 Jan 2022, 05:12 AM IST
Last checked17 Oct 2026
Kusto query · 15 linesTable: AlertInfo · Microsoft Defender XDR / Sentinel
AlertInfo| where Title in~('Suspicious script launched','Exploitation attempt against Log4j (CVE-2021-44228)','Suspicious process executed by a network service','Possible target of Log4j exploitation (CVE-2021-44228)','Possible target of Log4j exploitation','Possible Log4j exploitation','Network connection seen in CVE-2021-44228 exploitation','Log4j exploitation detected','Possible exploitation of CVE-2021-44228','Possible target of Log4j vulnerability (CVE-2021-44228) scanning','Possible source of Log4j exploitation','Log4j exploitation attempt via cloud application', // Previously titled Exploitation attempt against Log4j'Log4j exploitation attempt via email' // Previously titled Log4j Exploitation Attempt)SecOps Signal does not execute queries against private telemetry. Paste the query into Microsoft Sentinel Log Analytics or Defender advanced hunting and review it first. Passed structure and schema checks; tenant execution is not verified.
Query anatomy
Static check against a reviewed column list— This query has no final project stage to list.
“Listed” only means the column name appears in the reviewed list for that table. It does not confirm the column exists in your tenant's current schema, and per-column purposes are not recorded.
Hunting notes
MITRE ATT&CKNot mapped
Analytical purpose
Source repository hunting query
When to use
Review the source query and adapt it to your tenant before use.
Limitations
Schema checked only. This query has not been executed against a Sentinel or Defender tenant.