Proxy requests with URI ending in .class extension
Flags proxy requests whose URI path ends with .class, useful for identifying potential Java class downloads.
FreeReviewedSigma · Medium · v5
- Category
- proxy
- Author
- Andreas Hunkeler (@Karneades) (SigmaHQ), DRL 1.1
- Published
- 2021-12-21
- Updated
- 2026-07-31
What it detects
Identifies proxy log requests where the requested URI ends with the .class file extension. This behavior can indicate attempts to retrieve Java class files directly, which may be part of initial access or follow-on payload delivery. The detection relies on proxy telemetry containing the full requested URI.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
proxy-requests-for-class-uri-extensions-53c15703
title: Proxy requests with URI ending in .class extension
id: 81c5d8a4-79d8-4f11-926a-504869ef7cbb
status: test
description: Identifies proxy log requests where the requested URI ends with the .class file extension. This behavior can indicate attempts to retrieve Java class files directly, which may be part of initial access or follow-on payload delivery. The detection relies on proxy telemetry containing the full requested URI.
references:
- https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/web/proxy_generic/proxy_susp_class_extension_request.yml
author: Andreas Hunkeler (@Karneades), Huntrule Team
date: 2021-12-21
modified: 2024-02-26
tags:
- attack.initial-access
- detection.threat-hunting
logsource:
category: proxy
detection:
selection:
c-uri|endswith: .class
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 53c15703-b04c-42bb-9055-1937ddfb3392
type: derived