Log4Shell (CVE-2021-44228) is more than four years old, and it is still the reference point for every "how did this get in?" conversation. If you are building a detection playbook today, Log4j is the right template — not because it is current, but because it shows exactly how a logging library becomes a remote code execution vector.

The mechanism in one paragraph

Log4j's message substitution feature let a logged string trigger a JNDI lookup. An attacker who could get an application to log a crafted string — a username, a user-agent, a header — could make the JVM connect to an attacker-controlled LDAP or RMI server and load a payload. No authentication, no user interaction beyond the request.

The lesson generalises: any component that parses structured input and then acts on it is a potential execution surface. Logging frameworks are just the most common example.

Detection: find it before you patch it

Manual auditing does not scale.…