Windows Log4j/Wstomcat-related Process Execution via ws_tomcatservice.exe Parent
Detects processes spawned by ws_tomcatservice.exe on Windows, excluding repadmin.exe, to surface potential Tomcat exploitation.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), MSTIC (idea) (SigmaHQ), DRL 1.1
- Published
- 2023-04-20
- Updated
- 2026-07-31
What it detects
This rule identifies process creation events where the parent process is named ws_tomcatservice.exe. Such chaining can indicate attempts to execute attacker-controlled binaries from a Java/Tomcat service context. The detection relies on Windows process creation telemetry and matches parent/child image paths, while excluding cases involving repadmin.exe as the spawned image.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/04/18/nation-state-threat-actor-mint-sandstorm-refines-tradecraft-to-attack-high-value-targets/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Mint-Sandstorm/proc_creation_win_apt_mint_sandstorm_log4j_wstomcat_execution.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-wstomcatservice-exe-parent-spawning-processes-log4j-wst-7c97c625
title: Windows Log4j/Wstomcat-related Process Execution via ws_tomcatservice.exe Parent
id: 3a6b0359-e395-4488-86ab-d12cfb3b6cea
status: test
description: This rule identifies process creation events where the parent process is named ws_tomcatservice.exe. Such chaining can indicate attempts to execute attacker-controlled binaries from a Java/Tomcat service context. The detection relies on Windows process creation telemetry and matches parent/child image paths, while excluding cases involving repadmin.exe as the spawned image.
references:
- https://www.microsoft.com/en-us/security/blog/2023/04/18/nation-state-threat-actor-mint-sandstorm-refines-tradecraft-to-attack-high-value-targets/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Mint-Sandstorm/proc_creation_win_apt_mint_sandstorm_log4j_wstomcat_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), MSTIC (idea), Huntrule Team
date: 2023-04-20
modified: 2023-11-29
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \ws_tomcatservice.exe
filter_main_repadmin:
Image|endswith: \repadmin.exe
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 7c97c625-0350-4f0a-8943-f6cadc88125e
type: derived