JVM Application Error Logs: OGNL Injection Exploitation Indicators

Detects ERROR-level JVM application log entries containing OGNL parsing/syntax exception indicators that may suggest OGNL injection attempts.

FreeUnreviewedSigmahighv1

jvm-application-error-logs-ognl-injection-exploitation-indicators-4d0af518

title: "JVM Application Error Logs: OGNL Injection Exploitation Indicators"
id: 1b6476d9-8f06-47d8-8d82-b3ef9550ae52
status: test
description: This rule flags JVM-based applications where error logs contain OGNL-related parsing or syntax exceptions, which can indicate attempted OGNL injection. Such attempts may be used to achieve remote code execution in affected expression-evaluating features. The detection relies on application error log telemetry at ERROR level or higher and searches for specific OGNL exception and expression syntax error keywords.
references:
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/jvm/java_ognl_injection_exploitation_attempt.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2017-5638
  - cve.2022-26134
logsource:
  category: application
  product: jvm
  definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
  keywords:
    - org.apache.commons.ognl.OgnlException
    - ExpressionSyntaxException
  condition: keywords
falsepositives:
  - Application bugs
level: high
license: DRL-1.1
related:
  - id: 4d0af518-828e-4a04-a751-a7d03f3046ad
    type: derived

What it detects

This rule flags JVM-based applications where error logs contain OGNL-related parsing or syntax exceptions, which can indicate attempted OGNL injection. Such attempts may be used to achieve remote code execution in affected expression-evaluating features. The detection relies on application error log telemetry at ERROR level or higher and searches for specific OGNL exception and expression syntax error keywords.

Known false positives

Application bugs

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.