Sigma rule: Java Payload Strings

Rule

Title

Java Payload Strings

Status

test

Level

high

Author

frack113, Harjot Singh, "@cyb3rjy0t" (update)

Date

2022-06-04

Modified

2023-01-19

File

rules/web/webserver_generic/web_java_payload_in_access_logs.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects possible Java payloads in web access logs

Log source

category

webserver

Detection

keywords:
    - '%24%7B%28%23a%3D%40'
    - '${(#a=@'
    - '%24%7B%40java'
    - '${@java'
    - 'u0022java'
    - '%2F%24%7B%23'
    - '/${#'
    - 'new+java.'
    - 'getRuntime().exec('
    - 'getRuntime%28%29.exec%28'
condition: keywords

False positives (as the rule lists them)

• Legitimate apps

Tags

• cve.2022-26134
• cve.2021-26084
• attack.initial-access
• attack.t1190

CVEs this rule names

• CVE-2021-26084
• CVE-2022-26134

MITRE ATT&CK ids this rule names

• T1190

References

• https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/
• https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/
• https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md
• https://twitter.com/httpvoid0x2f/status/1532924261035384832
• https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/webserver_generic/web_java_payload_in_access_logs.yml