Detectionhightest

Potential Server Side Template Injection In Velocity

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Moti HarmatsCreated Sat Feb 1116c86189-b556-4ee8-b4c7-7e350a195a4fapplication

Log Source

velocityapplication

Productvelocity← raw: velocity

Categoryapplication← raw: application

Definition

Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)

Detection Logic

detection:
    keywords:
        - 'ParseErrorException'
        - 'VelocityException'
        - 'TemplateInitException'
    condition: keywords

False Positives

Application bugs

Missing .vm files

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

16c86189-b556-4ee8-b4c7-7e350a195a4f

Status

test

Level

high

Type

Detection

Created

Sat Feb 11

Author

Path

rules/application/velocity/velocity_ssti_injection.yml

Raw Tags

attack.initial-accessattack.t1190