Sigma rule: Server Side Template Injection Strings

Rule

Title

Server Side Template Injection Strings

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-06-14

File

rules/web/webserver_generic/web_ssti_in_access_logs.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects SSTI attempts sent via GET requests in access logs

Log source

category

webserver

Detection

select_method:
    cs-method: 'GET'
keywords:
    - '={{'
    - '=%7B%7B'
    - '=${'
    - '=$%7B'
    - '=<%='
    - '=%3C%25='
    - '=@('
    - 'freemarker.template.utility.Execute'
    - .getClass().forName('javax.script.ScriptEngineManager')
    - 'T(org.apache.commons.io.IOUtils)'
filter:
    sc-status: 404
condition: select_method and keywords and not filter

False positives (as the rule lists them)

• User searches in search boxes of the respective website
• Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes

Tags

• attack.stealth
• attack.t1221

MITRE ATT&CK ids this rule names

• T1221

References

• https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection
• https://github.com/payloadbox/ssti-payloads

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/webserver_generic/web_ssti_in_access_logs.yml