Platform / product
jvm Sigma detection rules
5 community-maintained Sigma detection rules in the library target the jvm platform, covering log sources such as application. Browse by severity, inspect the detection logic and MITRE ATT&CK mapping, and open the original Sigma YAML before using a rule in your detection engineering workflow.
Log sources
Severity
Potential JNDI Injection Exploitation In JVM Based Application
highDetects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.
jvm · application
Potential Local File Read Vulnerability In JVM Based Application
highDetects potential local file read vulnerability in JVM based apps. If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
jvm · application
Potential OGNL Injection Exploitation In JVM Based Application
highDetects potential OGNL Injection exploitation, which may lead to RCE. OGNL is an expression language that is supported in many JVM based systems. OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)
jvm · application
Potential XXE Exploitation Attempt In JVM Based Application
highDetects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.
jvm · application
Process Execution Error In JVM Based Application
highDetects process execution related exceptions in JVM based apps, often relates to RCE
jvm · application