Microsoft Azure – Check for Apache Log4J Vulnerability in Azure VMs
In this article, we’ll be finding the Apache Log4J Application is Installed in Azure Servers or Not by using Azure Portal. As logging to servers is not possible at a time to find Log4J We’ll use KQL Query to find it.
With the help of KQL Query, we will be finding the Detecting Log4j Installed Servers by using the Azure Monitor service in Azure Portal.
KQL Query:
ConfigurationData | distinct FileSystemPath
This query is used to all the unique file paths in the disks from the select scope.
KQL Query:
ConfigurationData
| where FileSystemPath contains "log4j"
| project Computer, FileSystemPath
Output:
- If you don’t find any Computer Name and File System Path. i.e., You can consider that your servers are not having Apache Log4J vulnerability.
ConfigurationData
| where FileSystemPath contains "liblog4j2-java"
| project Computer, FileSystemPath
Output:
- If here also, you don’t find any Computer Name and File System Path. i.e., You can consider that your servers are not having Apache Log4J vulnerability.
KQL Query:
ConfigurationData | distinct SoftwareName
This query is used to find all the unique Software Names.
KQL Query:
ConfigurationData
| where SoftwareName contains "log4j"
| project Computer, SoftwareName
Output:
- Again if you don’t find any Computer Name and Software Name. i.e., You can consider that your servers are not having Apache Log4J vulnerability.
KQL Query:
ConfigurationData
| where SoftwareName contains "liblog4j2-java"
| project Computer, SoftwareName
Output:
Reference:
Last Updated :
30 Mar, 2023
Like Article
Save Article
Share your thoughts in the comments
Please Login to comment...