huntrule

Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-23
Updated
2026-10-23
AnalysisDetection

ATT&CK techniques

Initial Access → Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the Apache Tomcat process (which backs Confluence) spawning cmd.exe or powershell.exe, the post-exploitation behavior seen when adversaries exploited a Confluence vulnerability to deploy ransomware per Red Canary. A web application server launching a command interpreter almost always indicates successful remote code execution against the exposed service.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Malicious BeyondTrust Bomgar Agent Spawning Command Shell via Remote Support Exploitation (via process_creation)
Malicious WSUS Service Spawning Command Shell via CVE-2025-59287 (via process_creation)
Malicious SharePoint w3wp Spawning Command Shell and PowerShell
Suspicious Child Process Spawned by Triofox GladinetCloudMonitor
Malicious PowerShell UrlDecode Payload Spawned by SQL Server after FortiClient EMS Exploitation
Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell
Suspicious SolarWinds Web Help Desk Java Process Spawning Command Shell
Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit
Suspicious PowerShell Out-of-Band Request to Interactsh Domain
Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.