Linux Java Process Spawning Shells and Downloaders

title: Linux Java Process Spawning Shells and Downloaders
id: c07ce6d8-a0c1-4ee8-9cf6-3d36d5f1b91d
status: test
description: This rule flags Linux process creations where the parent process is a Java binary and its command line indicates the spawning of common interactive shells (sh/bash/dash/ksh/zsh/csh/fish) or scripting/downloading tools (curl/wget/python). Such activity can indicate an attacker using a Java process as a launcher to execute commands or fetch additional payloads. The detection relies on process creation telemetry, specifically parent image paths and command-line contents.
references:
  - https://www.tecmint.com/different-types-of-linux-shells/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_java_children.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-03
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /java
    CommandLine|contains:
      - /bin/sh
      - bash
      - dash
      - ksh
      - zsh
      - csh
      - fish
      - curl
      - wget
      - python
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d292e0af-9a18-420c-9525-ec0ac3936892
    type: derived