CanarytokensCanarytokens
Home
Guide
Create
GitHub
Home
Guide
Create
GitHub
  • Create
  • Guide

    • Introduction
    • Getting Started
  • Examples

    • How to use the examples
    • Adobe PDF Canarytoken
    • AWS API Keys Canarytoken
    • AWS Infrastructure Canarytoken
    • Azure Entra ID login token
    • Azure Login Certificate Canarytoken
    • Cloned Website Canarytoken
    • Credit Card Canarytoken
    • CrowdStrike Client Credential Canarytoken
    • CSS Cloned Website Canarytoken
    • Custom EXE Canarytoken
    • DNS Canarytoken
    • Fake App Canarytoken
    • HTTP Canarytoken
    • Fake IdP SAML App Canarytoken
    • Kubeconfig Token
    • Log4shell Canarytoken
    • MS Excel Canarytoken
    • MS Word Canarytoken
    • MySQL Dump Canarytoken
    • Network Folder Canarytoken
    • QR Code Canarytoken
    • Fast Redirect Canarytoken
    • Slow Redirect Canarytoken
    • Sensitive Command Canarytoken
    • SQL Server Canarytoken
    • SVG Canarytoken
    • SVN Canarytoken
    • Unique email address Canarytoken
    • Web Image Canarytoken
    • Windows Directory Canarytoken
    • WireGuard Canarytoken

Log4shell Canarytoken

What is the Log4shell Canarytoken

This Canarytoken will alert if log4j logline is consumed by a vulnerable log4j library.

Using a Log4shell Canarytoken

Create a Canarytoken by choosing the "Log4shell" tile.

Once you've created the Canarytoken, we'll provide you with a log4j snippet you can copy to test your systems for the log4shell issue. If the log line is consumed by a vulnerable log4j library, it will generate an alert on this Canarytoken. If this works, you will also obtain the hostname of the vulnerable server.

Help us improve this page!
Last Updated: 9/26/25, 7:57 AM
Prev
Kubeconfig Token
Next
MS Excel Canarytoken