Potential OGNL Expression Injection Exploitation in JVM Application Logs
Detects ERROR-level JVM application log entries containing OGNL parsing/syntax exception indicators that may suggest OGNL injection attempts.
- Product
- jvm
- Category
- application
- Author
- Moti Harmats (SigmaHQ), DRL 1.1
- Published
- 2023-02-11
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags application error log messages that contain OGNL-related exception indicators, suggesting a potential OGNL expression injection attempt. Attackers may use OGNL injection to execute malicious expressions and potentially achieve remote code execution in vulnerable JVM-based applications. Detection relies on collecting application error logs and matching specific keyword strings tied to OGNL and expression parsing failures.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Potential OGNL Expression Injection Exploitation in JVM Application Logs
id: 1b6476d9-8f06-47d8-8d82-b3ef9550ae52
status: test
description: This rule flags application error log messages that contain OGNL-related exception indicators, suggesting a potential OGNL expression injection attempt. Attackers may use OGNL injection to execute malicious expressions and potentially achieve remote code execution in vulnerable JVM-based applications. Detection relies on collecting application error logs and matching specific keyword strings tied to OGNL and expression parsing failures.
references:
- https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/jvm/java_ognl_injection_exploitation_attempt.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
- attack.initial-access
- attack.t1190
- cve.2017-5638
- cve.2022-26134
logsource:
category: application
product: jvm
definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
keywords:
- org.apache.commons.ognl.OgnlException
- ExpressionSyntaxException
condition: keywords
falsepositives:
- Application bugs
level: high
license: DRL-1.1
related:
- id: 4d0af518-828e-4a04-a751-a7d03f3046ad
type: derived