Windows keytool.exe Spawns Suspicious Command-Line Shell Processes

title: Windows keytool.exe Spawns Suspicious Command-Line Shell Processes
id: 02a4122a-95ae-4149-aacf-b9c332a2a5d5
status: test
description: This rule flags process creations where the parent process is keytool.exe and the child process image ends with common command or script execution utilities (for example cmd.exe, powershell.exe, wmic.exe, mshta.exe, rundll32.exe). Such chaining is suspicious because Java tooling should typically not spawn interactive shells or system utilities that can be used for execution, discovery, or persistence after initial access. It relies on Windows process creation telemetry, specifically parent-child process image paths and names.
references:
  - https://redcanary.com/blog/intelligence-insights-december-2021
  - https://www.synacktiv.com/en/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_java_keytool_susp_child_process.yml
author: Andreas Hunkeler (@Karneades), Huntrule Team
date: 2021-12-22
modified: 2023-01-21
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \keytool.exe
    Image|endswith:
      - \cmd.exe
      - \sh.exe
      - \bash.exe
      - \powershell.exe
      - \pwsh.exe
      - \schtasks.exe
      - \certutil.exe
      - \whoami.exe
      - \bitsadmin.exe
      - \wscript.exe
      - \cscript.exe
      - \scrcons.exe
      - \regsvr32.exe
      - \hh.exe
      - \wmic.exe
      - \mshta.exe
      - \rundll32.exe
      - \forfiles.exe
      - \scriptrunner.exe
      - \mftrace.exe
      - \AppVLP.exe
      - \systeminfo.exe
      - \reg.exe
      - \query.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 90fb5e62-ca1f-4e22-b42e-cc521874c938
    type: derived