Detectionhightest

Potential XXE Exploitation Attempt In JVM Based Application

Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Moti HarmatsCreated Sat Feb 11c4e06896-e27c-4583-95ac-91ce2279345dapplication

Log Source

jvmapplication

Productjvm← raw: jvm

Categoryapplication← raw: application

Definition

Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)

Detection Logic

detection:
    keywords:
        - 'SAXParseException'
        - 'DOMException'
    condition: keywords

False Positives

If the application expects to work with XML there may be parsing issues that don't necessarily mean XXE.

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

c4e06896-e27c-4583-95ac-91ce2279345d

Status

test

Level

high

Type

Detection

Created

Sat Feb 11

Author

Path

rules/application/jvm/java_xxe_exploitation_attempt.yml

Raw Tags

attack.initial-accessattack.t1190