JVM Process Execution Exceptions in Application Logs
Flags JVM error logs showing failed process execution (ProcessBuilder/ProcessImpl) that may reflect attempted command execution.
- Product
- jvm
- Category
- application
- Author
- Moti Harmats (SigmaHQ), DRL 1.1
- Published
- 2023-02-11
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags application error logs that indicate failed process execution in JVM-based applications, including messages such as 'Cannot run program' and references to Java process APIs (java.lang.ProcessImpl, java.lang.ProcessBuilder). Such failures can occur when an attacker attempts to trigger arbitrary command execution or when exploit attempts fail due to input validation or runtime restrictions. The detection relies on collected application error log text containing specific exception keywords.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: JVM Process Execution Exceptions in Application Logs
id: e4e73081-2df9-4c33-98b3-7cbd32972ed9
status: test
description: This rule flags application error logs that indicate failed process execution in JVM-based applications, including messages such as 'Cannot run program' and references to Java process APIs (java.lang.ProcessImpl, java.lang.ProcessBuilder). Such failures can occur when an attacker attempts to trigger arbitrary command execution or when exploit attempts fail due to input validation or runtime restrictions. The detection relies on collected application error log text containing specific exception keywords.
references:
- https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/jvm/java_rce_exploitation_attempt.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
- attack.initial-access
- attack.t1190
logsource:
category: application
product: jvm
definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
keywords:
- Cannot run program
- java.lang.ProcessImpl
- java.lang.ProcessBuilder
condition: keywords
falsepositives:
- Application bugs
level: high
license: DRL-1.1
related:
- id: d65f37da-a26a-48f8-8159-3dde96680ad2
type: derived