Hello Eveyrone, Is there any Generic use case/AQL which we have for log4J vulnerbility? I have seen some use cases/AQL which are giving lot of False Positives. Appreciate any pointers on the same.

I use the below AQL script to query and pull the logs related to Log4J exploit attempt in our environment.

SELECT QIDNAME(qid) AS "Event Name", sourceip AS "Source IP", destinationip AS "Destination IP", destinationport as "Destination Port",DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss z') AS "Log Source Time",LOGSOURCENAME(logsourceid) AS "Log Source","URL" as 'URL',"ACTION" as 'Action',"EVENT_ID" as "Custom_event", SUM(eventcount) FROM events WHERE UTF8(payload) IMATCHES '.*\$(\{|%7B)[^\}]*?j.*?n.*?d.*?i.*' and devicetype != 105 GROUP BY "Event Name","Source IP" LAST 24 HOURS

Hi,

or take a look here:

https://community.ibm.com/community/user/security/blogs/adam-frank/2021/12/13/detection-of-log4shell-using-qradar?CommunityKey=f9ea5420-0984-4345-ba7a-d93b4e2d4864&tab=recentcommunityblogsdashboard

Regards,

Ralph