Windows: Alert on Java.exe Spawning Suspicious System and Script Binaries

title: "Windows: Alert on Java.exe Spawning Suspicious System and Script Binaries"
id: f71695f1-b2c9-46d6-a547-dcaf83d8eb15
related:
  - id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0
    type: similar
  - id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d
    type: derived
status: test
description: This rule flags Windows process creation events where the parent process ends with '\java.exe' and the spawned child process matches a list of common system, scripting, and utility binaries. Such parent-child relationships can indicate exploitation or follow-on activity where attackers use Java as an initial execution context before running additional tools. It relies on process creation telemetry capturing the parent image path and the child image path/filename.
references:
  - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_java_susp_child_process.yml
author: Andreas Hunkeler (@Karneades), Florian Roth, Huntrule Team
date: 2021-12-17
modified: 2024-01-18
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \java.exe
    Image|endswith:
      - \AppVLP.exe
      - \bitsadmin.exe
      - \certutil.exe
      - \cscript.exe
      - \curl.exe
      - \forfiles.exe
      - \hh.exe
      - \mftrace.exe
      - \mshta.exe
      - \net.exe
      - \net1.exe
      - \query.exe
      - \reg.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \schtasks.exe
      - \scrcons.exe
      - \scriptrunner.exe
      - \sh.exe
      - \systeminfo.exe
      - \whoami.exe
      - \wmic.exe
      - \wscript.exe
  condition: selection
falsepositives:
  - Legitimate calls to system binaries
  - Company specific internal usage
level: high
license: DRL-1.1