Spring Framework Security Exceptions Indicating Suspicious Access and CSRF Handling (Java)

Alerts on Spring Security exception keywords related to access denial, CSRF, cookies, and request rejection in application logs.

FreeUnreviewedSigmamediumv1

spring-framework-security-exceptions-indicating-suspicious-access-and-csrf-handl-ae48ab93

title: Spring Framework Security Exceptions Indicating Suspicious Access and CSRF Handling (Java)
id: db1b31bd-e40c-4239-b45a-2688b73f5db1
status: stable
description: This rule flags application log events containing specific Spring Security-related exception names tied to authorization failures, CSRF validation, cookie integrity, and request rejection. Such exceptions can surface during probing or attempted exploitation when attackers trigger or manipulate security controls to reach protected functionality. The detection relies on application log text matching the listed exception keywords.
references:
  - https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/spring/spring_application_exceptions.yml
author: Thomas Patzke, Huntrule Team
date: 2017-08-06
modified: 2020-09-01
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: spring
detection:
  keywords:
    - AccessDeniedException
    - CsrfException
    - InvalidCsrfTokenException
    - MissingCsrfTokenException
    - CookieTheftException
    - InvalidCookieException
    - RequestRejectedException
  condition: keywords
falsepositives:
  - Application bugs
level: medium
license: DRL-1.1
related:
  - id: ae48ab93-45f7-4051-9dfe-5d30a3f78e33
    type: derived

What it detects

This rule flags application log events containing specific Spring Security-related exception names tied to authorization failures, CSRF validation, cookie integrity, and request rejection. Such exceptions can surface during probing or attempted exploitation when attackers trigger or manipulate security controls to reach protected functionality. The detection relies on application log text matching the listed exception keywords.

Known false positives

Application bugs

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.