Windows: Java.exe spawning command shell processes

Alerts when java.exe launches cmd, PowerShell, or bash on Windows, a potential sign of command execution.

FreeUnreviewedSigmamediumv1

windows-java-exe-spawning-command-shell-processes-dff1e1cc

title: "Windows: Java.exe spawning command shell processes"
id: 9a38e81b-0c5a-4629-9bd6-5641823766b0
related:
  - id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d
    type: similar
  - id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0
    type: derived
status: test
description: This rule flags Windows process creation events where java.exe is the parent process and it spawns a shell executable such as bash.exe, cmd.exe, powershell.exe, or pwsh.exe. Such parent-child relationships can indicate malicious execution chains, including attempts to run commands after initial access. The detection relies on Windows process creation telemetry, specifically parent image paths and spawned image names along with process command-line context exclusions for build-related activity.
references:
  - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_java_susp_child_process_2.yml
author: Andreas Hunkeler (@Karneades), Nasreddine Bencherchali, Huntrule Team
date: 2021-12-17
modified: 2024-01-18
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \java.exe
    Image|endswith:
      - \bash.exe
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
  filter_main_build:
    ParentImage|contains: build
    CommandLine|contains: build
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate calls to system binaries
  - Company specific internal usage
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process creation events where java.exe is the parent process and it spawns a shell executable such as bash.exe, cmd.exe, powershell.exe, or pwsh.exe. Such parent-child relationships can indicate malicious execution chains, including attempts to run commands after initial access. The detection relies on Windows process creation telemetry, specifically parent image paths and spawned image names along with process command-line context exclusions for build-related activity.

Known false positives

Legitimate calls to system binaries
Company specific internal usage

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.