GitHub Repo

Detection: Java Class File download by Java User Agent

Updated Date: 2026-05-13 ID: 8281ce42-5c50-11ec-82d2-acde48001122 Author: Michael Haag, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic identifies a Java user agent performing a GET request for a .class file from a remote site. It leverages web or proxy logs within the Web Datamodel to detect this activity. This behavior is significant as it may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell). If confirmed malicious, an attacker could exploit vulnerabilities in the Java application, potentially leading to remote code execution and further compromise of the affected system.

 1
 2| tstats  `security_content_summariesonly` count FROM datamodel=Web
 3  WHERE Web.http_user_agent="*Java*" Web.http_method="GET" Web.url="*.class*"
 4  BY Web.http_user_agent Web.http_method, Web.url,Web.url_length
 5     Web.src, Web.dest
 6
 7| `drop_dm_object_name("Web")`
 8
 9| `security_content_ctime(firstTime)`
10
11| `security_content_ctime(lastTime)`
12
13| `java_class_file_download_by_java_user_agent_filter`

Data Source

Name Platform Sourcetype Source
Splunk Stream HTTP Splunk icon Splunk 'stream:http' 'stream:http'

Macros Used

Name Value
security_content_summariesonly summariesonly=summariesonly_config allow_old_summaries=oldsummaries_config fillnull_value=fillnull_config``
java_class_file_download_by_java_user_agent_filter search *
java_class_file_download_by_java_user_agent_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1190 Exploit Public-Facing Application Initial Access
Delivery
DE.CM
CIS 13

CVE

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Finding (Notable) Yes
Rule Title %name%
Rule Description %description%
Notable Event Fields user, dest
Creates Intermediate Finding (Risk Event) No
TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.

Known False Positives

Filtering may be required in some instances, filter as needed.

Associated Analytic Story

Finding

Title Entity Field Entity Type Risk Score
A Java user agent $http_user_agent$ was performing a $http_method$ to retrieve a remote class file. dest system 50

Threat Objects

Field Type
http_user_agent http_user_agent

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset stream:http stream:http
Integration ✅ Passing Dataset stream:http stream:http

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 10