---
title: "Apache Struts Vulnerability"
last_modified_at: 2018-12-06
toc: true
tags:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  - Endpoint
---

#### Description

Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.

- **ID**: 2dcfd6a2-e7d2-4873-b6ba-adaf819d2a1e
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2018-12-06
- **Author**: Rico Valdez, Splunk

#### Detection profiles

| Name        | Technique   | Type         |
| ----------- | ----------- |--------------|
| [Suspicious Java Classes](/application/suspicious_java_classes/) | None | Anomaly |
| [Unusually Long Content-Type Length](/network/unusually_long_content-type_length/) | None | Anomaly |
| [Web Servers Executing Suspicious Processes](/application/web_servers_executing_suspicious_processes/) | None | TTP |

#### Reference

* [https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf](https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf)



[*source*](https://github.com/splunk/security_content/tree/develop/stories/apache_struts_vulnerability.yml) \| *version*: **1**