mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
57 lines
2.4 KiB
YAML
57 lines
2.4 KiB
YAML
name: Suspicious Java Classes
|
|
id: 6ed33786-5e87-4f55-b62c-cb5f1168b831
|
|
version: 9
|
|
creation_date: '2019-10-16'
|
|
modification_date: '2026-05-13'
|
|
author: Jose Hernandez, Splunk
|
|
status: experimental
|
|
type: Anomaly
|
|
description: |-
|
|
The following analytic identifies suspicious Java classes often used for remote command execution exploits in Java frameworks like Apache Struts.
|
|
It detects this activity by analyzing HTTP POST requests with specific content patterns using Splunk's `stream_http` data source.
|
|
This behavior is significant because it may indicate an attempt to exploit vulnerabilities in web applications, potentially leading to unauthorized remote code execution.
|
|
If confirmed malicious, this activity could allow attackers to execute arbitrary commands on the server, leading to data breaches, system compromise, and further network infiltration.
|
|
data_source: []
|
|
search: |-
|
|
`stream_http`
|
|
http_method=POST
|
|
http_content_length>1
|
|
| regex form_data="(?i)java\.lang\.(?:runtime|processbuilder)"
|
|
| rename src_ip as src
|
|
| stats count earliest(_time) as firstTime
|
|
latest(_time) as lastTime
|
|
values(url) as uri
|
|
values(status) as status
|
|
values(http_user_agent) as http_user_agent
|
|
BY src dest
|
|
| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`
|
|
| `suspicious_java_classes_filter`
|
|
how_to_implement: |-
|
|
In order to properly run this search, Splunk needs to ingest data from your web-traffic appliances that serve or sit in the path of your Struts application servers.
|
|
This can be accomplished by indexing data from a web proxy, or by using network traffic-analysis tools, such as Splunk Stream or Bro.
|
|
known_false_positives: |-
|
|
No false positives have been identified at this time.
|
|
references: []
|
|
intermediate_findings:
|
|
entities:
|
|
- field: src
|
|
type: system
|
|
score: 20
|
|
message: Suspicious Java Classes in HTTP requests involving $src$ and $dest$
|
|
- field: dest
|
|
type: system
|
|
score: 20
|
|
message: Suspicious Java Classes in HTTP requests involving $src$ and $dest$
|
|
analytic_story:
|
|
- Apache Struts Vulnerability
|
|
asset_type: Endpoint
|
|
mitre_attack_id:
|
|
- T1190
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
category: application
|
|
security_domain: threat
|