Windows Process Creation: javaw.exe Command Line Indicates Adwind/JRAT Roaming Oracle Path
Flags command-line patterns indicating javaw.exe execution from AppData\Roaming\Oracle with java/.exe markers.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2017-11-10
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events whose command lines reference an AppData Roaming Oracle directory along with javaw.exe-related execution patterns. Attackers commonly use Java-based RATs and launcher components to maintain stealth and persistence, making these path and command-line indicators valuable for early identification. The detection relies on process creation telemetry with the full CommandLine field captured by the Windows process auditing pipeline.
Reporting behind it
- hybrid-analysis.comhttps://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100
- first.orghttps://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/Adwind-RAT/proc_creation_win_malware_adwind.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: javaw.exe Command Line Indicates Adwind/JRAT Roaming Oracle Path"
id: 00acc51a-b95c-4100-ad83-7b483f93588b
status: test
description: This rule flags Windows process creation events whose command lines reference an AppData Roaming Oracle directory along with javaw.exe-related execution patterns. Attackers commonly use Java-based RATs and launcher components to maintain stealth and persistence, making these path and command-line indicators valuable for early identification. The detection relies on process creation telemetry with the full CommandLine field captured by the Windows process auditing pipeline.
references:
- https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100
- https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/Adwind-RAT/proc_creation_win_malware_adwind.yml
author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2017-11-10
modified: 2022-10-09
tags:
- attack.execution
- attack.t1059.005
- attack.t1059.007
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
- CommandLine|contains|all:
- \AppData\Roaming\Oracle
- \java
- ".exe "
- CommandLine|contains|all:
- cscript.exe
- Retrive
- ".vbs "
condition: selection
level: high
license: DRL-1.1
related:
- id: 1fac1481-2dbc-48b2-9096-753c49b4ec71
type: derived