Query: log4shell_vulnerability

select
  tp_timestamp as timestamp,
request_method as operation,
request_uri as resource,
status,
http_user_agent as actor,
tp_source_ip as source_ip,
tp_id as source_id,
-- Create new aliases to preserve original row data
status as status_src,
timestamp as timestamp_src,
*
exclude (status, timestamp)

from
  apache_access_log
where
  request_uri is not null
  and (
    -- JNDI lookup patterns
    request_uri ilike '%${jndi:%'
    or request_uri ilike '%$%7bjndi:%'
    or request_uri ilike '%${%7bjndi:%'
    or request_uri ilike '%jndi://%'
        
    -- Common protocol exploits
    or request_uri ilike '%jndi:ldap:%'
    or request_uri ilike '%jndi:dns:%'
    or request_uri ilike '%jndi:rmi:%'
    or request_uri ilike '%jndi:http:%'
    or request_uri ilike '%jndi:iiop:%'
    or request_uri ilike '%jndi:corba:%'
        
    -- Base64 encoded variants
    or request_uri ilike '%jTmRp%'
    or request_uri ilike '%ak5kaQ%'
    or request_uri ilike '%JE5ESQB%'
    or request_uri ilike '%SnNkaQ%'
  )
order by
  tp_timestamp desc;