Windows: java.exe Parent Spawning cmd/powershell/bash Processes
Alerts when java.exe launches cmd, PowerShell, or bash on Windows, a potential sign of command execution.
- Product
- windows
- Category
- process_creation
- Author
- Andreas Hunkeler (@Karneades), Nasreddine Bencherchali (SigmaHQ), DRL 1.1
- Published
- 2021-12-17
- Updated
- 2026-07-31
What it detects
This rule identifies Windows process creation events where java.exe is the parent process and it spawns a command shell (cmd.exe, PowerShell, pwsh) or a bash.exe. Such parent-child execution patterns can indicate malicious execution flow following application exploitation or other unauthorized command execution. The detection relies on Windows process creation telemetry, specifically parent image paths and child image/command lines matching the listed shells, with an exclusion for build-related activity.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: java.exe Parent Spawning cmd/powershell/bash Processes"
id: 9a38e81b-0c5a-4629-9bd6-5641823766b0
related:
- id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d
type: similar
- id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0
type: derived
status: test
description: This rule identifies Windows process creation events where java.exe is the parent process and it spawns a command shell (cmd.exe, PowerShell, pwsh) or a bash.exe. Such parent-child execution patterns can indicate malicious execution flow following application exploitation or other unauthorized command execution. The detection relies on Windows process creation telemetry, specifically parent image paths and child image/command lines matching the listed shells, with an exclusion for build-related activity.
references:
- https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_java_susp_child_process_2.yml
author: Andreas Hunkeler (@Karneades), Nasreddine Bencherchali, Huntrule Team
date: 2021-12-17
modified: 2024-01-18
tags:
- attack.initial-access
- attack.persistence
- attack.privilege-escalation
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \java.exe
Image|endswith:
- \bash.exe
- \cmd.exe
- \powershell.exe
- \pwsh.exe
filter_main_build:
ParentImage|contains: build
CommandLine|contains: build
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate calls to system binaries
- Company specific internal usage
level: medium
license: DRL-1.1