Windows Process Creation: Java Deserialization Exploitation via DesktopCentral_Server JVM Parent and Script/Tool Child

title: "Windows Process Creation: Java Deserialization Exploitation via DesktopCentral_Server JVM Parent and Script/Tool Child"
id: 0119108e-5270-44be-b78d-9e99d626928e
status: test
description: This rule flags Windows process executions where the parent process is a specific Zoho ManageEngine Desktop Central Java runtime (DesktopCentral_Server\jre\bin\java.exe) and the child process is one of several command-line or system-discovery utilities (cmd.exe, powershell/pwsh, bitsadmin, systeminfo, net/net1, reg, query). Such behavior matters because it indicates an exploited server-side context spawning follow-on commands to run actions and collect environment details. The detection relies on process creation telemetry that records parent and child image paths and uses suffix matching to identify the relevant JVM parent and the spawned tools.
references:
  - https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html
  - https://vulmon.com/exploitdetails?qidtp=exploitdb&qid=48224
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-10189/proc_creation_win_exploit_cve_2020_10189.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-03-25
modified: 2023-01-21
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - attack.s0190
  - cve.2020-10189
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: DesktopCentral_Server\jre\bin\java.exe
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
      - \bitsadmin.exe
      - \systeminfo.exe
      - \net.exe
      - \net1.exe
      - \reg.exe
      - \query.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 846b866e-2a57-46ee-8e16-85fa92759be7
    type: derived