Java Web Application Exploit Payload Strings in Web Logs
Detects attempts to exploit Java-based web applications by identifying common payload strings often used in vulnerabilities like those affecting Confluence (CVE-2022-26134, CVE-2021-26084) and other Java deserialization or expression language injection flaws. The rule looks for specific patterns in web access logs that indicate the presence of Java code execution attempts, such as references to Java classes, runtime execution commands, and encoded characters often used in exploit payloads.
Sigma
