What pattern identifies Log4j exploitation?

• A. ${jndi:ldap://...}
• B. GET /index.html
• C. <script>
• D. HTTP/1.1 200 OK

Answer: (A)

Log4j exploitation hinges on a JNDI lookup embedded in log data. The pattern ${jndi:ldap://...} is the exact signature used to trigger a remote code fetch and execution when Log4j 2 processes a log message containing it. If a vulnerable version logs a string with that pattern, it may contact the LDAP server and load attacker-supplied code, giving the attacker control over the application. The other options are unrelated to this mechanism: a plain GET request, a script tag, or a normal HTTP status line are everyday HTTP artifacts and do not invoke a JNDI-based remote code load.