6 Ways to Quickly Detect a Log4Shell Exploit in Your Environment | Qualys
Summary: Qualys outlines six detection opportunities for Log4Shell (CVE-2021-44228 and CVE-2021-45046), an input-validation flaw in Log4j2 that lets attackers use JNDI lookups to reach LDAP, RMI, CORBA and DNS services and run arbitrary code remotely. The post notes that only failed exploit attempts appear in logs, since a successful payload executes without a log entry, and that obfuscation such as ${lower:j}${lower:n}${lower:d}${lower:i} can evade simple string searches for "JNDI".
Why it matters: A successful Log4Shell exploit leaves no log entry, so log inspection alone will miss the compromise - and with Java running on 15 billion devices worldwide, the attack surface is enormous. Qualys also reports Bazarloader among the malware families already observed exploiting the flaw, pointing to use by well-known adversarial groups.