Sunturai
Back to results
MediumSplunk security contentMichael Haag +1

Java Class File download by Java User Agent

The following analytic identifies a Java user agent performing a GET request for a .class file from a remote site. It leverages web or proxy logs within the Web Datamodel to detect this activity. This behavior is…

Description

The following analytic identifies a Java user agent performing a GET request for a .class file from a remote site. It leverages web or proxy logs within the Web Datamodel to detect this activity. This behavior is significant as it may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell). If confirmed malicious, an attacker could exploit vulnerabilities in the Java application, potentially leading to remote code execution and further compromise of the affected system.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
splunk_stream_http

Known benign triggers

  • Filtering may be required in some instances, filter as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice