Potential OGNL Injection Exploitation In JVM Based Application — Sigma Rule

Rule metadata and linked tags

Author: Moti Harmats. Source status: test; severity: high. Source dates: 2023-02-11 / not supplied.

{
  "category": "application",
  "product": "jvm",
  "definition": "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 7582d0b53d70580574eefdd40ecf018ce80c24443fde8a5484b64862bd948795

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Potential OGNL Injection Exploitation In JVM Based Application
id: 4d0af518-828e-4a04-a751-a7d03f3046ad
status: test
description: |
    Detects potential OGNL Injection exploitation, which may lead to RCE.
    OGNL is an expression language that is supported in many JVM based systems.
    OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)
references:
    - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
author: Moti Harmats
date: 2023-02-11
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2017-5638
    - cve.2022-26134
logsource:
    category: application
    product: jvm
    definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'
detection:
    keywords:
        - 'org.apache.commons.ognl.OgnlException'
        - 'ExpressionSyntaxException'
    condition: keywords
falsepositives:
    - Application bugs
level: high

Original YAML and metadata in JSON

False positives

• Application bugs

Source references

• https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs