Java Payload Indicators in Web Access Logs

title: Java Payload Indicators in Web Access Logs
id: d27a5f44-2576-4565-ae4d-67fd4eb45595
status: test
description: This rule flags web requests containing URL-encoded or inline Java payload-like strings, including common template/script patterns and Java runtime execution fragments. Such indicators matter because attackers often probe or deliver server-side code through crafted payloads embedded in HTTP requests. The detection relies on matching specific keyword substrings within web server access log content.
references:
  - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/
  - https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/
  - https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md
  - https://twitter.com/httpvoid0x2f/status/1532924261035384832
  - https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_java_payload_in_access_logs.yml
author: frack113, Harjot Singh, "@cyb3rjy0t" (update), Huntrule Team
date: 2022-06-04
modified: 2023-01-19
tags:
  - cve.2022-26134
  - cve.2021-26084
  - attack.initial-access
  - attack.t1190
logsource:
  category: webserver
detection:
  keywords:
    - "%24%7B%28%23a%3D%40"
    - ${(#a=@
    - "%24%7B%40java"
    - ${@java
    - u0022java
    - "%2F%24%7B%23"
    - /${#
    - new+java.
    - getRuntime().exec(
    - getRuntime%28%29.exec%28
  condition: keywords
falsepositives:
  - Legitimate apps
level: high
license: DRL-1.1
related:
  - id: 583aa0a2-30b1-4d62-8bf3-ab73689efe6c
    type: derived