Linux Java Process Launching Suspicious Shell and Scripting Children

title: Linux Java Process Launching Suspicious Shell and Scripting Children
id: c07ce6d8-a0c1-4ee8-9cf6-3d36d5f1b91d
status: test
description: This rule flags Linux process creation events where a parent process image ends with /java and the command line contains indicators of common shells and scripting/utility tools. Attackers may use Java applications to spawn interpreters or download and execute additional tooling, enabling execution, staging, or persistence. The detection relies on process creation telemetry, specifically the parent process path and the child process command line contents.
references:
  - https://www.tecmint.com/different-types-of-linux-shells/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_java_children.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-03
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /java
    CommandLine|contains:
      - /bin/sh
      - bash
      - dash
      - ksh
      - zsh
      - csh
      - fish
      - curl
      - wget
      - python
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d292e0af-9a18-420c-9525-ec0ac3936892
    type: derived