Windows Process Creation: Java exploitation chain targeting Zoho ManageEngine Desktop Central (CVE-2020-10189)
Alerts on cmd/Pwsh/BITSAdmin and other command utilities launched by the Desktop Central Java runtime.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-03-25
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where cmd.exe, PowerShell, pwsh, bitsadmin, systeminfo, net/net1, reg, or query are launched under a specific Desktop Central server Java runtime process. Such parent/child process relationships can indicate an exploitation-driven post-compromise workflow rather than normal administration. It relies on process creation telemetry that includes executable image paths for both the parent Java process and the spawned command utility.
Reporting behind it
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html
- vulmon.comhttps://vulmon.com/exploitdetails?qidtp=exploitdb&qid=48224
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-10189/proc_creation_win_exploit_cve_2020_10189.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Java exploitation chain targeting Zoho ManageEngine Desktop Central (CVE-2020-10189)"
id: 0119108e-5270-44be-b78d-9e99d626928e
status: test
description: This rule flags Windows process creation events where cmd.exe, PowerShell, pwsh, bitsadmin, systeminfo, net/net1, reg, or query are launched under a specific Desktop Central server Java runtime process. Such parent/child process relationships can indicate an exploitation-driven post-compromise workflow rather than normal administration. It relies on process creation telemetry that includes executable image paths for both the parent Java process and the spawned command utility.
references:
- https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html
- https://vulmon.com/exploitdetails?qidtp=exploitdb&qid=48224
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-10189/proc_creation_win_exploit_cve_2020_10189.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-03-25
modified: 2023-01-21
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.001
- attack.t1059.003
- attack.s0190
- cve.2020-10189
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: DesktopCentral_Server\jre\bin\java.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \bitsadmin.exe
- \systeminfo.exe
- \net.exe
- \net1.exe
- \reg.exe
- \query.exe
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 846b866e-2a57-46ee-8e16-85fa92759be7
type: derived