Skip to content

Latest commit

 

History

History
26 lines (21 loc) · 1.37 KB

Log4j-Microsoft-Defender.md

File metadata and controls

26 lines (21 loc) · 1.37 KB
Raw

Log4j Microsoft Defender queries

Find callback connections

Possible Malicious Indicators in Cloud Application Events. This query is designed to flag exploitation attempts for cases where the attacker is sending the crafted exploitation string using vectors such as User-Agent, Application or Account name. The hits returned from this query are most likely unsuccessful attempts, however the results can be useful to identity attackers’ details such as IP address, Payload string, Download URL, etc.

CloudAppEvents
| where Timestamp > datetime("2021-12-09")
| where UserAgent contains "jndi:" 
or AccountDisplayName contains "jndi:"
or Application contains "jndi:"
or AdditionalFields contains "jndi:"
| project ActionType, ActivityType, Application, AccountDisplayName, IPAddress, UserAgent, AdditionalFields

Possible vulnerable applications via Threat and Vulnerability Management

This query looks for possibly vulnerable applications using the affected Log4j component. Triage the results to determine applications and programs that may need to be patched and updated.

DeviceTvmSoftwareInventory
| where SoftwareName contains "log4j"
| project DeviceName, SoftwareName, SoftwareVersion

Find callback connections

Microsoft's Azure Sentinel IoC List