Potential SpEL Injection Attempts Triggering Spring ExpressionException (Application Logs)
Alerts on Spring ExpressionException errors that may indicate potential SpEL injection attempts.
- Product
- spring
- Category
- application
- Author
- Moti Harmats (SigmaHQ), DRL 1.1
- Published
- 2023-02-11
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags application error log entries from Spring that include org.springframework.expression.ExpressionException, indicating a failed or malformed Spring Expression Language (SpEL) evaluation attempt. Attackers may use SpEL injection to execute arbitrary logic within the application, which can escalate to remote code execution depending on the context. The detection relies on collecting Spring application error logs at ERROR level or higher and matching the observed exception message text.
Reporting behind it
- owasp.orghttps://owasp.org/www-community/vulnerabilities/Expression_Language_Injection
- wix.engineeringhttps://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/spring/spring_spel_injection.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Potential SpEL Injection Attempts Triggering Spring ExpressionException (Application Logs)
id: 9df87070-8ba1-4538-bd0d-77ec88e6a308
status: test
description: This rule flags application error log entries from Spring that include org.springframework.expression.ExpressionException, indicating a failed or malformed Spring Expression Language (SpEL) evaluation attempt. Attackers may use SpEL injection to execute arbitrary logic within the application, which can escalate to remote code execution depending on the context. The detection relies on collecting Spring application error logs at ERROR level or higher and matching the observed exception message text.
references:
- https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection
- https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/spring/spring_spel_injection.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
- attack.initial-access
- attack.t1190
logsource:
category: application
product: spring
definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
keywords:
- org.springframework.expression.ExpressionException
condition: keywords
falsepositives:
- Application bugs
level: high
license: DRL-1.1
related:
- id: e9edd087-89d8-48c9-b0b4-5b9bb10896b8
type: derived