Query: detect Detects suspicious Spring framework exceptions that could indicate exploitation attempts in logs
Matching passage: Sigma rule: Detects suspicious Spring framework exceptions that could indicate exploitation attempts. Logsource: spring / application. Rule: title: Spring Framework Exceptions id: ae48ab93-45f7-4051-9dfe-5d30a3f78e33 status: stable description: Detects suspicious Spring framework exceptions that could indicate exploitation attempts references: - https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html author: Thomas Patzke date: 2017-08-06 modified: 2020-09-01 tags: - attack.initial-access - attack.t1190 logsource: category: application product: spring detection: keywords: - AccessDeniedException - CsrfException - InvalidCsrfTokenException - MissingCsrfTokenException - CookieTheftException - InvalidCookieException - RequestRejectedException condition: keywords falsepositives: - Application bugs level: medium
Near-miss passage: Sigma rule: Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter). Logsource: windows / process_creation. Rule: title: Suspicious SYSTEM User Process Creation id: 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09 status: test description: Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter) references: - Internal Research - https://tools.thehacker.recipes/mimikatz/modules author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) date: 2021-12-20 modified: 2025-10-19 tags: - attack.credential-access - attack.privilege-escalation - attack.stealth - attack.t1134 - attack.t1003 - attack.t1027 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - System - S-1-16-16384 User|contains: - AUTHORI - AUTORI selection_special: - Image|endswith: - \calc.exe - \cscript.exe - \forfiles.exe - \hh.exe - \mshta.exe - \ping.exe - \wscript.exe - CommandLine|re: net\s+user\s+ - CommandLine|contains: - ' -NoP ' - ' -W Hidden ' - ' -decode ' - ' /decode ' - ' /urlcache ' - ' -urlcache ' - ' -e* JAB' - ' -e* SUVYI' - ' -e* SQBFAFgA' - ' -e* aWV4I' - ' -e* IAB' - ' -e* PAA' - ' -e* aQBlAHgA' - vssadmin delete shadows - reg SAVE HKLM - ' -ma ' - Microsoft\Windows\CurrentVersion\Run - .downloadstring( - .downloadfile( - ' /ticket:' - 'dpapi::' - event::clear - event::drop - id::modify - 'kerberos::' - 'lsadump::' - 'misc::' - 'privilege::' - 'rpc::' - 'sekurlsa::' - 'sid::' - 'token::' - vault::cred - vault::list - ' p::d ' - ;iex( - MiniDump filter_main_ping: CommandLine|contains|all: - ping - 127.0.0.1 - ' -n ' filter_vs: Image|endswith: \PING.EXE ParentCommandLine|contains: \DismFoDInstall.cmd filter_config_mgr: ParentImage|contains: :\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ filter_java: ParentImage|contains: - :\Program Files (x86)\Java\ - :\Program Files\Java\ ParentImage|endswith: \bin\javaws.exe Image|contains: - :\Program Files (x86)\Java\ - :\Program Files\Java\ Image|endswith: \bin\jp2launcher.exe CommandLine|contains: ' -ma ' condition: all of selection* and not 1 of filter_* falsepositives: - Administrative activity - Scripts and administrative tools used in the monitored environment - Monitoring activity level: high