huntrule

JVM Process Execution Error Messages Indicating Failed Program Launch

Flags JVM error logs showing failed process execution (ProcessBuilder/ProcessImpl) that may reflect attempted command execution.

FreeUnreviewedSigmahighv1
title: JVM Process Execution Error Messages Indicating Failed Program Launch
id: e4e73081-2df9-4c33-98b3-7cbd32972ed9
status: test
description: This rule matches application error messages that indicate a JVM-based process failed to launch, including common text such as “Cannot run program” along with Java ProcessImpl/ProcessBuilder class names. Such failures can be triggered by malicious attempts to execute system commands (for example, as part of exploitation), making the error context useful for investigation. It relies on collected application error logs containing those specific keywords at ERROR level or higher.
references:
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/jvm/java_rce_exploitation_attempt.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: jvm
  definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
  keywords:
    - Cannot run program
    - java.lang.ProcessImpl
    - java.lang.ProcessBuilder
  condition: keywords
falsepositives:
  - Application bugs
level: high
license: DRL-1.1
related:
  - id: d65f37da-a26a-48f8-8159-3dde96680ad2
    type: derived

What it detects

This rule matches application error messages that indicate a JVM-based process failed to launch, including common text such as “Cannot run program” along with Java ProcessImpl/ProcessBuilder class names. Such failures can be triggered by malicious attempts to execute system commands (for example, as part of exploitation), making the error context useful for investigation. It relies on collected application error logs containing those specific keywords at ERROR level or higher.

Known false positives

  • Application bugs

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.