JVM Application Errors Indicating Local File Read Path Traversal Attempts

title: JVM Application Errors Indicating Local File Read Path Traversal Attempts
id: 1fa74da3-ad64-4c2b-b98b-46b2768c19f7
status: test
description: This rule flags application error logs from JVM-based applications where FileNotFoundException appears alongside path traversal-style strings such as /../../.. . Such patterns can indicate an attempt to coerce the application into reading files outside the intended directory. It relies on application error telemetry containing exception text and raw request-related payload fragments that were logged during failure handling.
references:
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/jvm/java_local_file_read.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: jvm
  definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
  keywords_local_file_read:
    "|all":
      - FileNotFoundException
      - /../../..
  condition: keywords_local_file_read
falsepositives:
  - Application bugs
level: high
license: DRL-1.1
related:
  - id: e032f5bc-4563-4096-ae3b-064bab588685
    type: derived