Suspicious Spring Framework Exceptions (via application)

This rule detects anomalous Spring framework exceptions that could indicate exploitation attempts

Sigmamediumv1

sigma

suspicious-spring-framework-exceptions-via-application

title: Suspicious Spring Framework Exceptions (via application)
id: 56a5315f-5700-5012-b183-ef4133027ba1
status: stable
description: This rule detects anomalous Spring framework exceptions that could indicate exploitation attempts
references:
    - https://attack.mitre.org/techniques/T1190/
    - https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html
author: Huntrule Team
date: 2026-04-14
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: application
    product: spring
detection:
    keywords:
        - AccessDeniedException
        - CsrfException
        - InvalidCsrfTokenException
        - MissingCsrfTokenException
        - CookieTheftException
        - InvalidCookieException
        - RequestRejectedException
    condition: keywords
falsepositives:
    - Unknown
level: medium

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.