Query: Sigma YAML for jvm / application
Matching passage: Sigma rule: Detects process execution related exceptions in JVM based apps, often relates to RCE. Logsource: jvm / application. Rule: title: Process Execution Error In JVM Based Application id: d65f37da-a26a-48f8-8159-3dde96680ad2 status: test description: Detects process execution related exceptions in JVM based apps, often relates to RCE references: - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 logsource: category: application product: jvm definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - Cannot run program - java.lang.ProcessImpl - java.lang.ProcessBuilder condition: keywords falsepositives: - Application bugs level: high
Near-miss passage: Sigma rule: Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging. The AutoLogg. Logsource: windows / registry_set. Rule: title: Potential AutoLogger Sessions Tampering id: f37b4bce-49d0-4087-9f5b-58bffda77316 related: - id: d7b81144-b866-48a4-9bcc-275dc69d870e type: similar status: test description: 'Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging. The AutoLogger event tracing session records events up that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in, and also used by security solutions as telemetry source. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events. ' references: - https://twitter.com/MichalKoczwara/status/1553634816016498688 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2025-12-26 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection_main: TargetObject|contains: \Control\WMI\Autologger\ selection_values: TargetObject|contains: - \EventLog- - \Defender TargetObject|endswith: - \Enabled - \Start Details: DWORD (0x00000000) filter_main_wevtutil: Image: C:\Windows\system32\wevtutil.exe filter_main_defender: Image|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ - C:\Program Files (x86)\Windows Defender\ Image|endswith: \MsMpEng.exe TargetObject|contains: - \DefenderApiLogger\ - \DefenderAuditLogger\ condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_autologger_sessions/info.yml simulation: - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd technique: T1562.001 atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell technique: T1562.001 atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c - type: