HTTP Request for .Class Extension URI

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•35

Detects HTTP requests to URIs ending with the ".class" extension. This can indicate attempts to download Java classes, potentially as part of exploitation attacks such as Log4shell against Log4j vulnerabilities. This rule is useful for threat hunting to identify such activities.