← Sentinel Explorer

↳ GitHub sourceWorkbook

Log4j Post Compromise Hunting

View on GitHub ↗Original file ↗

Description

This hunting workbook is intended to help identify activity related to the Log4j compromise discovered in December 2021.

Version: 1.0.0
Declared author / publisher: Microsoft Sentinel Community

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

SecurityNestedRecommendation AzureDiagnostics OfficeActivity W3CIISLog AWSCloudTrail SigninLogs AADNonInteractiveUserSignInLogs imWebSessions imNetworkSession

Related content

Links established from declared identifiers and solution manifests.

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Apache Log4j Vulnerability Detection/Workbooks/Log4jPostCompromiseHunting.json ↗
Commit: 9800e51 ↗
Source identifier: Log4jPostCompromiseHuntingWorkbook

Additional source files 4

Solutions/Apache Log4j Vulnerability Detection/Workbooks/Log4jPostCompromiseHunting.jsonsource ↗Workbooks/WorkbooksMetadata.jsonworkbook-metadata ↗Workbooks/Log4jPostCompromiseHunting.jsonsource-occurrence ↗Solutions/Apache Log4j Vulnerability Detection/Data/Solution_Log4j.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.