Process Execution Error In JVM Based Application

calendar Aug 12, 2024 · attack.initial-access attack.t1190  ·
Share on: linkedin copy

Detects process execution related exceptions in JVM based apps, often relates to RCE

Sigma rule (View on GitHub)

 1title: Process Execution Error In JVM Based Application
 2id: d65f37da-a26a-48f8-8159-3dde96680ad2
 3status: test
 4description: Detects process execution related exceptions in JVM based apps, often relates to RCE
 5references:
 6    - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
 7author: Moti Harmats
 8date: 2023-02-11
 9tags:
10    - attack.initial-access
11    - attack.t1190
12logsource:
13    category: application
14    product: jvm
15    definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'
16detection:
17    keywords:
18        - 'Cannot run program'
19        - 'java.lang.ProcessImpl'
20        - 'java.lang.ProcessBuilder'
21    condition: keywords
22falsepositives:
23    - Application bugs
24level: high

References

  • Threat and Vulnerability Hunting with Application Server Error Logs

    IntroductionWhen doing application security at scale, you have to make peace with the fact that some issues may as well find their way into production. While we work hard to make sure this almost never happens, we understand that it’s just a fact of life that sometimes some things can slip into production without proper security controls.Photo by Mahdi Bafande on UnsplashThat’s why in addition to constantly “shifting left” our efforts and trying to secure all frameworks “by design”, one of the c


    Read More

Related rules

to-top