Skip to content
skopnix
Section E · Detections · Rule
← IBM QRadar detectionsIBM QRadar · CVE exploitation

CVE-2016-3081 exploitation attempt

AQLhighconfidence 90/100generated 2026-10-18

Web request carrying the exploit observable of CVE-2016-3081 (CISA KEV, EPSS 0.95, public PoC), taken from the public nuclei template.

ATT&CK
T1190 mitre ↗
Linked CVE
CVE-2016-3081
False positives
Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

AQL search

skopnix-qradar-cve-cve-2016-3081-0677da47.aqldownload .aql ↓
SELECT sourceip, destinationip, destinationport, QIDNAME(qid) AS event, LOGSOURCENAME(logsourceid) AS log_source, "URL"
FROM events
WHERE ("URL" ILIKE '%/index.action%' AND "URL" ILIKE '%method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString%')
LAST 7 DAYS

CRE rule (build in Offenses > Rules)

download .txt ↓
Rule name: "Skopnix: CVE-2016-3081 exploitation attempt"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [your web server / WAF / proxy log sources]
  - and when the event matches this AQL filter query: ("URL" ILIKE '%/index.action%' AND "URL" ILIKE '%method:%23_memberAccess%3d@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23res%3d%40org.apache.struts2.ServletActionContext%40getResponse(),%23res.setCharacterEncoding(%23parameters.encoding%5B0%5D),%23w%3d%23res.getWriter(),%23s%3dnew+java.util.Scanner(@java.lang.Runtime@getRuntime().exec(%23parameters.cmd%5B0%5D).getInputStream()).useDelimiter(%23parameters.pp%5B0%5D),%23str%3d%23s.hasNext()%3f%23s.next()%3a%23parameters.ppp%5B0%5D,%23w.print(%23str),%23w.close(),1?%23xx:%23request.toString%')
Response: dispatch new event / create offense indexed by Destination IP (the targeted server); annotate "Skopnix CVE-2016-3081 attempt".
FP-safety: correlate with the HTTP status / response size; scanner noise is an attempt, not a breach.

How to deploy on IBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

References