CommonSecurityLog
| where DeviceVendor has 'Silverfort'
| where DeviceProduct has 'Admin Console'
| where DeviceEventClassID == "NewIncident"
| where Message has "Log4Shell"
| extend UserName = parse_json(replace('^""|""$', '', Message))['userName']
severity: High
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Silverfort/Analytic Rules/Log4Shell.yaml
id: d6abed70-4043-46da-9304-a98f3446fa5f
entityMappings:
- fieldMappings:
- identifier: Name
columnName: UserName
entityType: Account
kind: Scheduled
tactics:
- InitialAccess
queryFrequency: 15m
requiredDataConnectors:
- connectorId: SilverfortAma
dataTypes:
- CommonSecurityLog
relevantTechniques:
- T1190
version: 1.0.0
description: |
'Vulnerability allows attackers to execute arbitrary code on affected systems by exploiting a flaw in the way Log4j handles log messages containing specially crafted strings'
triggerThreshold: 0
query: |-
CommonSecurityLog
| where DeviceVendor has 'Silverfort'
| where DeviceProduct has 'Admin Console'
| where DeviceEventClassID == "NewIncident"
| where Message has "Log4Shell"
| extend UserName = parse_json(replace('^""|""$', '', Message))['userName']
queryPeriod: 15m
name: Silverfort - Log4Shell Incident
