alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects WRITE_DAC access to a domain object. Logsource: windows / security. Rule: title: AD Object WriteDAC Access id: 028c7842-4243-41cd-be6f-12f3cf1a26c7 status: test description: Detects WRITE_DAC access to a domain object references: - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html - https://threathunterplaybook.com/library/windows/active_directory_replication.html - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-09-12 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1222.001 logsource: product: windows service: security detection: selection: EventID: 4662 ObjectServer: DS AccessMask: '0x40000' ObjectType: - 19195a5b-6da0-11d0-afd3-00c04fd930c9 - domainDNS condition: selection falsepositives: - Unknown level: critical
Sigma rule: Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system pe. Logsource: windows / ps_script. Rule: title: Suspicious Get Local Groups Information - PowerShell id: fa6a5a45-3ee2-4529-aa14-ee5edc9e29cb related: - id: cef24b90-dddc-4ae1-a09a-8764872f69fc type: similar status: test description: 'Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md author: frack113 date: 2021-12-12 modified: 2025-08-22 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_localgroup: ScriptBlockText|contains: - 'get-localgroup ' - 'get-localgroupmember ' selection_wmi_module: ScriptBlockText|contains: - 'get-wmiobject ' - 'gwmi ' - 'get-ciminstance ' - 'gcim ' selection_wmi_class: ScriptBlockText|contains: win32_group condition: selection_localgroup or all of selection_wmi_* falsepositives: - Inventory scripts or admin tasks level: low
Sigma rule: Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed. Logsource: windows / process_creation. Rule: title: Suspicious Group And Account Reconnaissance Activity Using Net.EXE id: d95de845-b83c-4a9a-8a6a-4fc802ebf6c0 status: test description: 'Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM) ' references: - https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/ - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/ - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems) date: 2019-01-16 modified: 2023-03-02 tags: - attack.discovery - attack.t1087.001 - attack.t1087.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_group_root: CommandLine|contains: - ' group ' - ' localgroup ' selection_group_flags: CommandLine|contains: - domain admins - ' administrator' - ' administrateur' - enterprise admins - Exchange Trusted Subsystem - Remote Desktop Users - Utilisateurs du Bureau à distance - Usuarios de escritorio remoto - ' /do' filter_group_add: CommandLine|contains: ' /add' selection_accounts_root: CommandLine|contains: ' accounts ' selection_accounts_flags: CommandLine|contains: ' /do' condition: selection_img and ((all of selection_group_* and not filter_group_add) or all of selection_accounts_*) falsepositives: - Inventory tool runs - Administrative activity level: medium
Sigma rule: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as. Logsource: windows / image_load. Rule: title: Time Travel Debugging Utility Usage - Image id: e76c8240-d68f-4773-8880-5c6f63595aaf status: test description: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe. references: - https://lolbas-project.github.io/lolbas/Binaries/Tttracer/ - https://twitter.com/mattifestation/status/1196390321783025666 - https://twitter.com/oulusoyum/status/1191329746069655553 author: Ensar Şamil, @sblmsrsn, @oscd_initiative date: 2020-10-06 modified: 2022-12-02 tags: - attack.credential-access - attack.stealth - attack.t1218 - attack.t1003.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: - \ttdrecord.dll - \ttdwriter.dll - \ttdloader.dll condition: selection falsepositives: - Legitimate usage by software developers/testers level: high
Sigma rule: Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as thre. Logsource: windows / process_creation. Rule: title: Phishing Pattern ISO in Archive id: fcdf69e5-a3d3-452a-9724-26f2308bf2b1 status: test description: Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web) references: - https://twitter.com/1ZRR4H/status/1534259727059787783 - https://app.any.run/tasks/e1fe6a62-bce8-4323-a49a-63795d9afd5d/ author: Florian Roth (Nextron Systems) date: 2022-06-07 tags: - attack.initial-access - attack.t1566 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \Winrar.exe - \7zFM.exe - \peazip.exe Image|endswith: - \isoburn.exe - \PowerISO.exe - \ImgBurn.exe condition: selection falsepositives: - Legitimate cases in which archives contain ISO or IMG files and the user opens the archive and the image via clicking and not extraction level: high
Sigma rule: Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious. Logsource: windows / file_event. Rule: title: Suspicious Deno File Written from Remote Source id: 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e status: experimental description: 'Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it''s own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno. ' references: - https://taggart-tech.com/evildeno/ author: Josh Nickels, Michael Taggart date: 2025-05-22 tags: - attack.execution - attack.t1204 - attack.t1059.007 - attack.command-and-control - attack.t1105 logsource: category: file_event product: windows detection: selection_path: TargetFilename|contains: - \deno\gen\ - \deno\remote\https\ TargetFilename|contains|all: - :\Users\ - \AppData\ condition: selection_path falsepositives: - Legitimate usage of deno to request a file or bring a DLL to a host level: low
Sigma rule: Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary pro. Logsource: windows / image_load. Rule: title: Unsigned Mfdetours.DLL Sideloading id: 948a0953-f287-4806-bbcb-3b2e396df89f related: - id: d2605a99-2218-4894-8fd3-2afb7946514d type: similar status: test description: Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-11 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \mfdetours.dll filter_main_legit_path: ImageLoaded|contains: :\Program Files (x86)\Windows Kits\10\bin\ SignatureStatus: Valid condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Sigma rule: Detects the stopping of a Windows service via the "sc.exe" utility. Logsource: windows / process_creation. Rule: title: Stop Windows Service Via Sc.EXE id: 81bcb81b-5b1f-474b-b373-52c871aaa7b1 related: - id: eb87818d-db5d-49cc-a987-d5da331fbd90 type: obsolete status: test description: Detects the stopping of a Windows service via the "sc.exe" utility references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742107(v=ws.11) author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-05 modified: 2024-01-18 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: sc.exe - Image|endswith: \sc.exe selection_cli: CommandLine|contains: ' stop ' condition: all of selection_* falsepositives: - There are many legitimate reasons to stop a service. This rule isn't looking for any suspicious behavior in particular. Filter legitimate activity accordingly level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_sc_stop_service/info.yml
Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the c. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module id: 2f211361-7dce-442d-b78a-c04039677378 related: - id: 1b9dc62e-6e9e-42a3-8990-94d7a10007f7 type: derived status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2022-12-31 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_payload: - Payload|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - Payload|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - Payload|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - Payload|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2} - Payload|re: \*mdr\*\W\s*\)\.Name - Payload|re: \$VerbosePreference\.ToString\( - Payload|re: \[String\]\s*\$VerbosePreference condition: selection_payload falsepositives: - Unknown level: high
Sigma rule: Detects the creation of the default output filename used by the wmiexec tool. Logsource: windows / file_event. Rule: title: Wmiexec Default Output File id: 8d5aca11-22b3-4f22-b7ba-90e60533e1fb status: test description: Detects the creation of the default output filename used by the wmiexec tool references: - https://www.crowdstrike.com/blog/how-to-detect-and-prevent-impackets-wmiexec/ - https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-02 modified: 2023-03-08 tags: - attack.lateral-movement - attack.execution - attack.t1047 logsource: category: file_event product: windows detection: selection: - TargetFilename|re: \\Windows\\__1\d{9}\.\d{1,7}$ - TargetFilename|re: C:\\__1\d{9}\.\d{1,7}$ - TargetFilename|re: D:\\__1\d{9}\.\d{1,7}$ condition: selection falsepositives: - Unlikely level: critical
Sigma rule: Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command. Logsource: windows / process_creation. Rule: title: Obfuscated IP Download Activity id: cb5a2333-56cf-4562-8fcb-22ba1bca728d status: test description: Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command references: - https://h.43z.one/ipconverter/ - https://twitter.com/Yasser_Elsnbary/status/1553804135354564608 - https://twitter.com/fr0s7_/status/1712780207105404948 author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems) date: 2022-08-03 modified: 2026-03-16 tags: - attack.discovery logsource: category: process_creation product: windows detection: selection_command: CommandLine|contains: - Invoke-WebRequest - 'iwr ' - Invoke-RestMethod - 'irm ' - 'wget ' - 'curl ' - DownloadFile - DownloadString selection_ip_1: CommandLine|contains: - ' 0x' - //0x - .0x - .00x selection_ip_2: CommandLine|contains|all: - http://% - '%2e' selection_ip_3: - CommandLine|re: https?://[0-9]{1,3}\.[0-9]{1,3}\.0[0-9]{3,4} - CommandLine|re: https?://[0-9]{1,3}\.0[0-9]{3,7} - CommandLine|re: https?://0[0-9]{3,11} - CommandLine|re: https?://(?:0[0-9]{1,11}\.){3}0[0-9]{1,11} - CommandLine|re: https?://0[0-9]{1,11} - CommandLine|re: ' [0-7]{7,13}' filter_main_valid_ip: CommandLine|re: https?://(?:(?:25[0-5]|(?:2[0-4]|1\d|[1-9])?\d)(?:\.|\b)){4} condition: selection_command and 1 of selection_ip_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Sigma rule: Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp". Logsource: linux / file_event. Rule: title: Wget Creating Files in Tmp Directory id: 35a05c60-9012-49b6-a11f-6bab741c9f74 status: test description: Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp" references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.command-and-control - attack.t1105 logsource: product: linux category: file_event detection: selection: Image|endswith: /wget TargetFilename|startswith: - /tmp/ - /var/tmp/ condition: selection falsepositives: - Legitimate downloads of files in the tmp folder. level: medium
Sigma rule: Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic. Logsource: linux / process_creation. Rule: title: Flush Iptables Ufw Chain id: 3be619f4-d9ec-4ea8-a173-18fdd01996ab status: test description: Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic references: - https://blogs.blackberry.com/ - https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144 author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-01-18 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux category: process_creation detection: selection_img: Image|endswith: - /iptables - /xtables-legacy-multi - /iptables-legacy-multi - /ip6tables - /ip6tables-legacy-multi selection_params: CommandLine|contains: - -F - -Z - -X selection_ufw: CommandLine|contains: - ufw-logging-deny - ufw-logging-allow - ufw6-logging-deny - ufw6-logging-allow condition: all of selection_* falsepositives: - Network administrators level: medium
Sigma rule: Detects the addition of a new user to a privileged group such as "root" or "sudo". Logsource: linux. Rule: title: Privileged User Has Been Created id: 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e status: test description: Detects the addition of a new user to a privileged group such as "root" or "sudo" references: - https://digital.nhs.uk/cyber-alerts/2018/cc-2825 - https://linux.die.net/man/8/useradd - https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid author: Pawel Mazur date: 2022-12-21 modified: 2025-01-21 tags: - attack.privilege-escalation - attack.persistence - attack.t1136.001 - attack.t1098 logsource: product: linux definition: /var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work detection: selection_new_user: - new user selection_uids_gids: - GID=0, - UID=0, - GID=10, - GID=27, condition: all of selection_* falsepositives: - Administrative activity level: high
Sigma rule: Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (. Logsource: windows / process_creation. Rule: title: PowerShell MSI Install via WindowsInstaller COM From Remote Location id: 222720a7-047f-4054-baa5-bab9be757db0 status: experimental description: 'Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely. This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection. ' references: - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/ - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/ - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457 author: Meroujan Antonyan (vx3r) date: 2025-06-05 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1218 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - -ComObject - InstallProduct( selection_remote: CommandLine|contains: - http - \\\\ filter_main_localhost: CommandLine|contains: - ://127.0.0.1 - ://localhost condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Sigma rule: Detects identities attempting to enumerate their Kubernetes RBAC permissions. In the early stages of a breach, attackers. Logsource: kubernetes / application / audit. Rule: title: RBAC Permission Enumeration Attempt id: 84b777bd-c946-4d17-aa2e-c39f5a454325 status: test description: 'Detects identities attempting to enumerate their Kubernetes RBAC permissions. In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment. In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command. This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user''s authorization. ' references: - https://www.elastic.co/guide/en/security/current/kubernetes-suspicious-self-subject-review.html author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1069.003 - attack.t1087.004 - attack.discovery logsource: category: application product: kubernetes service: audit detection: selection: verb: create apiGroup: authorization.k8s.io objectRef.resource: selfsubjectrulesreviews condition: selection falsepositives: - Unknown level: low
Sigma rule: Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, whi. Logsource: windows / registry_set. Rule: title: Enable Local Manifest Installation With Winget id: fa277e82-9b78-42dd-b05c-05555c7b6015 status: test description: Detects changes to the AppInstaller (winget) policy. Specifically the activation of the local manifest installation, which allows a user to install new packages via custom manifests. references: - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 modified: 2023-08-17 tags: - attack.persistence - attack.stealth logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \AppInstaller\EnableLocalManifestFiles Details: DWORD (0x00000001) condition: selection falsepositives: - Administrators or developers might enable this for testing purposes or to install custom private packages level: medium
Sigma rule: Detects the use of 3proxy, a tiny free proxy server. Logsource: windows / process_creation. Rule: title: PUA - 3Proxy Execution id: f38a82d2-fba3-4781-b549-525efbec8506 status: test description: Detects the use of 3proxy, a tiny free proxy server references: - https://github.com/3proxy/3proxy - https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html author: Florian Roth (Nextron Systems) date: 2022-09-13 modified: 2023-02-21 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \3proxy.exe selection_pe: Description: 3proxy - tiny proxy server selection_params: CommandLine|contains: .exe -i127.0.0.1 -p condition: 1 of selection_* falsepositives: - Administrative activity level: high
Sigma rule: Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UA. Logsource: windows / process_creation. Rule: title: CMSTP UAC Bypass via COM Object Access id: 4b60e6f2-bf39-47b4-b4ea-398e33cfe253 status: stable description: Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65) references: - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/ - https://twitter.com/hFireF0X/status/897640081053364225 - https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf - https://github.com/hfiref0x/UACME author: Nik Seetharaman, Christian Burkard (Nextron Systems) date: 2019-07-31 modified: 2024-12-01 tags: - attack.execution - attack.privilege-escalation - attack.stealth - attack.t1548.002 - attack.t1218.003 - attack.g0069 - car.2019-04-001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \DllHost.exe ParentCommandLine|contains: - ' /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}' - ' /Processid:{3E000D72-A845-4CD9-BD83-80C07C3B881F}' - ' /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}' - ' /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}' - ' /Processid:{E9495B87-D950-4AB5-87A5-FF6D70BF3E90}' IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Legitimate CMSTP use (unlikely in modern enterprise environments) level: high
Sigma rule: Detects potential OGNL Injection exploitation, which may lead to RCE. OGNL is an expression language that is supported i. Logsource: jvm / application. Rule: title: Potential OGNL Injection Exploitation In JVM Based Application id: 4d0af518-828e-4a04-a751-a7d03f3046ad status: test description: 'Detects potential OGNL Injection exploitation, which may lead to RCE. OGNL is an expression language that is supported in many JVM based systems. OGNL Injection is the reason for some high profile RCE''s such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134) ' references: - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 - cve.2017-5638 - cve.2022-26134 logsource: category: application product: jvm definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - org.apache.commons.ognl.OgnlException - ExpressionSyntaxException condition: keywords falsepositives: - Application bugs level: high