Proxy requests for .class URI extensions

Flags proxy requests whose URI path ends with .class, useful for identifying potential Java class downloads.

FreeUnreviewedSigmamediumv1

proxy-requests-for-class-uri-extensions-53c15703

title: Proxy requests for .class URI extensions
id: 81c5d8a4-79d8-4f11-926a-504869ef7cbb
status: test
description: Identifies proxy log requests where the requested URI ends with the .class extension. Attackers may use this to retrieve Java class files during probing or exploitation, making these requests useful for hunting for suspicious content downloads. The rule relies on proxy telemetry that records the client request URI.
references:
  - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/web/proxy_generic/proxy_susp_class_extension_request.yml
author: Andreas Hunkeler (@Karneades), Huntrule Team
date: 2021-12-21
modified: 2024-02-26
tags:
  - attack.initial-access
  - detection.threat-hunting
logsource:
  category: proxy
detection:
  selection:
    c-uri|endswith: .class
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 53c15703-b04c-42bb-9055-1937ddfb3392
    type: derived

What it detects

Identifies proxy log requests where the requested URI ends with the .class extension. Attackers may use this to retrieve Java class files during probing or exploitation, making these requests useful for hunting for suspicious content downloads. The rule relies on proxy telemetry that records the client request URI.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.