JVM Application Errors Indicating Local File Read Path Traversal Attempts
JVM app error logs with FileNotFoundException plus /../../.. patterns can indicate attempted local file path traversal.
- Product
- jvm
- Category
- application
- Author
- Moti Harmats (SigmaHQ), DRL 1.1
- Published
- 2023-02-11
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags JVM-based applications when error logs contain a FileNotFoundException along with a path traversal-like sequence (/../../..). Such patterns suggest user-influenced input may be attempting to access local files outside the intended directory. It relies on application error telemetry capturing the relevant exception type and the traversal substring in the logged message or exception text.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: JVM Application Errors Indicating Local File Read Path Traversal Attempts
id: 1fa74da3-ad64-4c2b-b98b-46b2768c19f7
status: test
description: This rule flags JVM-based applications when error logs contain a FileNotFoundException along with a path traversal-like sequence (/../../..). Such patterns suggest user-influenced input may be attempting to access local files outside the intended directory. It relies on application error telemetry capturing the relevant exception type and the traversal substring in the logged message or exception text.
references:
- https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/jvm/java_local_file_read.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
- attack.initial-access
- attack.t1190
logsource:
category: application
product: jvm
definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
keywords_local_file_read:
"|all":
- FileNotFoundException
- /../../..
condition: keywords_local_file_read
falsepositives:
- Application bugs
level: high
license: DRL-1.1
related:
- id: e032f5bc-4563-4096-ae3b-064bab588685
type: derived