{"id":"583aa0a2-30b1-4d62-8bf3-ab73689efe6c","title":"Java Payload Strings","description":"Detects possible Java payloads in web access logs","author":"frack113, Harjot Singh, \"@cyb3rjy0t\" (update)","status":"test","level":"high","date":"2022-06-04","modified":"2023-01-19","tags":["cve.2022-26134","cve.2021-26084","attack.initial-access","attack.t1190"],"technique_ids":["T1190"],"logsource":{"category":"webserver"},"falsepositives":["Legitimate apps"],"references":["https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/","https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/","https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md","https://twitter.com/httpvoid0x2f/status/1532924261035384832","https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035"],"source_path":"rules/web/webserver_generic/web_java_payload_in_access_logs.yml","source_sha256":"aba3624d011e5006c97165749a97a8e32e2e822343887a3fe6299544ef51620d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_java_payload_in_access_logs.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Java Payload Strings\nid: 583aa0a2-30b1-4d62-8bf3-ab73689efe6c\nstatus: test\ndescription: Detects possible Java payloads in web access logs\nreferences:\n    - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/\n    - https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/\n    - https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md\n    - https://twitter.com/httpvoid0x2f/status/1532924261035384832\n    - https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035\nauthor: frack113, Harjot Singh, \"@cyb3rjy0t\" (update)\ndate: 2022-06-04\nmodified: 2023-01-19\ntags:\n    - cve.2022-26134\n    - cve.2021-26084\n    - attack.initial-access\n    - attack.t1190\nlogsource:\n    category: webserver\ndetection:\n    keywords:\n        - '%24%7B%28%23a%3D%40'\n        - '${(#a=@'\n        - '%24%7B%40java'\n        - '${@java'\n        - 'u0022java'\n        - '%2F%24%7B%23'\n        - '/${#'\n        - 'new+java.'\n        - 'getRuntime().exec('\n        - 'getRuntime%28%29.exec%28'\n    condition: keywords\nfalsepositives:\n    - Legitimate apps\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"}],"data_path":"data/detection-rules/583aa0a2-30b1-4d62-8bf3-ab73689efe6c.json","kind":"sigma"}