Windows: Alert on Java.exe Spawning Suspicious System and Script Binaries
Triggers when java.exe launches a child utility commonly abused for command execution and administration.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- process_creation
- Author
- Andreas Hunkeler (@Karneades), Florian Roth (SigmaHQ), DRL 1.1
- Published
- 2021-12-17
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creation events where the parent process ends with '\java.exe' and the spawned child process matches a list of common system, scripting, and utility binaries. Such parent-child relationships can indicate exploitation or follow-on activity where attackers use Java as an initial execution context before running additional tools. It relies on process creation telemetry capturing the parent image path and the child image path/filename.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-alert-on-suspicious-child-processes-spawned-by-java-exe-0d34ed8b
title: "Windows: Alert on Java.exe Spawning Suspicious System and Script Binaries"
id: f71695f1-b2c9-46d6-a547-dcaf83d8eb15
related:
- id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0
type: similar
- id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d
type: derived
status: test
description: This rule flags Windows process creation events where the parent process ends with '\java.exe' and the spawned child process matches a list of common system, scripting, and utility binaries. Such parent-child relationships can indicate exploitation or follow-on activity where attackers use Java as an initial execution context before running additional tools. It relies on process creation telemetry capturing the parent image path and the child image path/filename.
references:
- https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_java_susp_child_process.yml
author: Andreas Hunkeler (@Karneades), Florian Roth, Huntrule Team
date: 2021-12-17
modified: 2024-01-18
tags:
- attack.initial-access
- attack.persistence
- attack.privilege-escalation
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \java.exe
Image|endswith:
- \AppVLP.exe
- \bitsadmin.exe
- \certutil.exe
- \cscript.exe
- \curl.exe
- \forfiles.exe
- \hh.exe
- \mftrace.exe
- \mshta.exe
- \net.exe
- \net1.exe
- \query.exe
- \reg.exe
- \regsvr32.exe
- \rundll32.exe
- \schtasks.exe
- \scrcons.exe
- \scriptrunner.exe
- \sh.exe
- \systeminfo.exe
- \whoami.exe
- \wmic.exe
- \wscript.exe
condition: selection
falsepositives:
- Legitimate calls to system binaries
- Company specific internal usage
level: high
license: DRL-1.1