JVM Application Logs Indicating Potential XXE via XML Parser Exceptions
Alerts on JVM XML parsing exception messages in application error logs that may indicate attempted XXE exploitation.
- Product
- jvm
- Category
- application
- Author
- Moti Harmats (SigmaHQ), DRL 1.1
- Published
- 2023-02-11
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags JVM application error logs containing XML parser exceptions that may indicate XML processing problems consistent with potential XXE exploitation attempts. Attackers can abuse insecure XML parsing to influence external entity resolution, so unexpected parsing exceptions are a useful signal when XML input is handled. Detection relies on application error log telemetry matching keywords such as SAXParseException and DOMException.
Reporting behind it
- rules.sonarsource.comhttps://rules.sonarsource.com/java/RSPEC-2755
- owasp.orghttps://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
- wix.engineeringhttps://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/jvm/java_xxe_exploitation_attempt.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: JVM Application Logs Indicating Potential XXE via XML Parser Exceptions
id: c4be6445-b934-42cd-8f0a-6410a1052228
status: test
description: This rule flags JVM application error logs containing XML parser exceptions that may indicate XML processing problems consistent with potential XXE exploitation attempts. Attackers can abuse insecure XML parsing to influence external entity resolution, so unexpected parsing exceptions are a useful signal when XML input is handled. Detection relies on application error log telemetry matching keywords such as SAXParseException and DOMException.
references:
- https://rules.sonarsource.com/java/RSPEC-2755
- https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
- https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/jvm/java_xxe_exploitation_attempt.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
- attack.initial-access
- attack.t1190
logsource:
category: application
product: jvm
definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
keywords:
- SAXParseException
- DOMException
condition: keywords
falsepositives:
- If the application expects to work with XML there may be parsing issues that don't necessarily mean XXE.
level: high
license: DRL-1.1
related:
- id: c4e06896-e27c-4583-95ac-91ce2279345d
type: derived