# Escaping special characters to search for latest log4j exploit payload **URL:** \ **Category:** Kibana\ **Created:** [December 18, 2021, 2:00am UTC](https://discuss.elastic.co/t/escaping-special-characters-to-search-for-latest-log4j-exploit-payload/292369 "2021-12-18T02:00:35Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![RedInDisguise](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@RedInDisguise](https://discuss.elastic.co/u/RedInDisguise)\ **Post date:** [December 18, 2021, 2:00am UTC](https://discuss.elastic.co/t/escaping-special-characters-to-search-for-latest-log4j-exploit-payload/292369/1 "2021-12-18T02:00:35Z")
Hi all, Would anyone have ideas how to search for the latest log4j DOS exploit, example payload: "${${::-${::-$${::-j}}}}"? We are having trouble escaping the characters in a KQL search however open to a EQL search across all indices as well if that would work better. ---
**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\ **Post date:** [December 18, 2021, 3:50pm UTC](https://discuss.elastic.co/t/escaping-special-characters-to-search-for-latest-log4j-exploit-payload/292369/2 "2021-12-18T15:50:37Z")
Here is a blog post for detecting log4j exploit with elastic security [Detecting Exploitation of CVE-2021-44228 (log4j2) with Elastic Security | Elastic Blog](https://www.elastic.co/blog/detecting-log4j2-with-elastic-security) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 15, 2022, 3:50pm UTC](https://discuss.elastic.co/t/escaping-special-characters-to-search-for-latest-log4j-exploit-payload/292369/3 "2022-01-15T15:50:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.