Alerts related to Log4j vulnerability

id: ef76733a-86ab-4592-b341-64a4b369f4b7
name: Alerts related to Log4j vulnerability
description: |
  Microsoft has observed attackers exploiting vulnerabilities associated with Log4J.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
tactics:
- Vulnerability
query: |
  AlertInfo
  | where Title in~('Suspicious script launched',
  'Exploitation attempt against Log4j (CVE-2021-44228)',
  'Suspicious process executed by a network service',
  'Possible target of Log4j exploitation (CVE-2021-44228)',
  'Possible target of Log4j exploitation',
  'Possible Log4j exploitation',
  'Network connection seen in CVE-2021-44228 exploitation',
  'Log4j exploitation detected',
  'Possible exploitation of CVE-2021-44228',
  'Possible target of Log4j vulnerability (CVE-2021-44228) scanning',
  'Possible source of Log4j exploitation',
  'Log4j exploitation attempt via cloud application', // Previously titled Exploitation attempt against Log4j
  'Log4j exploitation attempt via email' // Previously titled Log4j Exploitation Attempt
  )