{"id":"ae48ab93-45f7-4051-9dfe-5d30a3f78e33","title":"Spring Framework Exceptions","description":"Detects suspicious Spring framework exceptions that could indicate exploitation attempts","author":"Thomas Patzke","status":"stable","level":"medium","date":"2017-08-06","modified":"2020-09-01","tags":["attack.initial-access","attack.t1190"],"technique_ids":["T1190"],"logsource":{"category":"application","product":"spring"},"falsepositives":["Application bugs"],"references":["https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html"],"source_path":"rules/application/spring/spring_application_exceptions.yml","source_sha256":"4d7c9c97af928fea1ec31a20aa958b977c9b3205766170a926c66e341c16fdfa","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/spring/spring_application_exceptions.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Spring Framework Exceptions\nid: ae48ab93-45f7-4051-9dfe-5d30a3f78e33\nstatus: stable\ndescription: Detects suspicious Spring framework exceptions that could indicate exploitation attempts\nreferences:\n    - https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html\nauthor: Thomas Patzke\ndate: 2017-08-06\nmodified: 2020-09-01\ntags:\n    - attack.initial-access\n    - attack.t1190\nlogsource:\n    category: application\n    product: spring\ndetection:\n    keywords:\n        - AccessDeniedException\n        - CsrfException\n        - InvalidCsrfTokenException\n        - MissingCsrfTokenException\n        - CookieTheftException\n        - InvalidCookieException\n        - RequestRejectedException\n    condition: keywords\nfalsepositives:\n    - Application bugs\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"}],"data_path":"data/detection-rules/ae48ab93-45f7-4051-9dfe-5d30a3f78e33.json","kind":"sigma"}