Java Payload Indicators in Web Server Logs
Alerts when web access logs contain Java payload-like strings indicating possible injection or runtime execution attempts.
- Category
- webserver
- Author
- frack113, Harjot Singh, "@cyb3rjy0t" (update) (SigmaHQ), DRL 1.1
- Published
- 2022-06-04
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags web access log entries containing common string patterns used in Java-based payloads, including URL-encoded and expression-style sequences. Such payloads are often used by attackers to attempt server-side code execution, making these log artifacts valuable for early investigation. Detection relies on matching predefined keyword fragments in webserver access logs.
Reporting behind it
- rapid7.comhttps://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/
- rapid7.comhttps://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/
- github.comhttps://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md
- twitter.comhttps://twitter.com/httpvoid0x2f/status/1532924261035384832
- medium.comhttps://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_java_payload_in_access_logs.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Java Payload Indicators in Web Server Logs
id: d27a5f44-2576-4565-ae4d-67fd4eb45595
status: test
description: This rule flags web access log entries containing common string patterns used in Java-based payloads, including URL-encoded and expression-style sequences. Such payloads are often used by attackers to attempt server-side code execution, making these log artifacts valuable for early investigation. Detection relies on matching predefined keyword fragments in webserver access logs.
references:
- https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/
- https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/
- https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md
- https://twitter.com/httpvoid0x2f/status/1532924261035384832
- https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035
- https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_java_payload_in_access_logs.yml
author: frack113, Harjot Singh, "@cyb3rjy0t" (update), Huntrule Team
date: 2022-06-04
modified: 2023-01-19
tags:
- cve.2022-26134
- cve.2021-26084
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
keywords:
- "%24%7B%28%23a%3D%40"
- ${(#a=@
- "%24%7B%40java"
- ${@java
- u0022java
- "%2F%24%7B%23"
- /${#
- new+java.
- getRuntime().exec(
- getRuntime%28%29.exec%28
condition: keywords
falsepositives:
- Legitimate apps
level: high
license: DRL-1.1
related:
- id: 583aa0a2-30b1-4d62-8bf3-ab73689efe6c
type: derived