Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)
Alerts when ManageEngine ServiceDesk Java spawns common attacker tools like PowerShell, certutil, mshta, or wmic.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-18
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies suspicious Windows process creations where the parent process path contains both the ManageEngine ServiceDesk directory and java.exe, and the resulting child process is one of several common command and scripting utilities (e.g., PowerShell, cmd-related tools, certutil, mshta, wmic). Such behavior is frequently abused during exploitation or post-exploitation when an attacker uses the service context to run additional binaries. It relies on Windows process creation telemetry with parent image path, child image path, and child command-line text, including a specific exclusion for net.exe/net1.exe commands containing " stop".
Reporting behind it
- horizon3.aihttps://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/
- github.comhttps://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py
- blog.viettelcybersecurity.comhttps://blog.viettelcybersecurity.com/saml-show-stopper/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_java_manageengine_susp_child_process.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)"
id: 25ca5b6e-674d-4a85-95d7-3b45671fd1e7
status: test
description: This rule identifies suspicious Windows process creations where the parent process path contains both the ManageEngine ServiceDesk directory and java.exe, and the resulting child process is one of several common command and scripting utilities (e.g., PowerShell, cmd-related tools, certutil, mshta, wmic). Such behavior is frequently abused during exploitation or post-exploitation when an attacker uses the service context to run additional binaries. It relies on Windows process creation telemetry with parent image path, child image path, and child command-line text, including a specific exclusion for net.exe/net1.exe commands containing " stop".
references:
- https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/
- https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py
- https://blog.viettelcybersecurity.com/saml-show-stopper/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_java_manageengine_susp_child_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2023-01-18
modified: 2023-08-29
tags:
- attack.command-and-control
- attack.t1102
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains|all:
- \ManageEngine\ServiceDesk\
- \java.exe
Image|endswith:
- \AppVLP.exe
- \bash.exe
- \bitsadmin.exe
- \calc.exe
- \certutil.exe
- \cscript.exe
- \curl.exe
- \forfiles.exe
- \mftrace.exe
- \mshta.exe
- \net.exe
- \net1.exe
- \notepad.exe
- \powershell.exe
- \pwsh.exe
- \query.exe
- \reg.exe
- \schtasks.exe
- \scrcons.exe
- \sh.exe
- \systeminfo.exe
- \whoami.exe
- \wmic.exe
- \wscript.exe
filter_main_net:
Image|endswith:
- \net.exe
- \net1.exe
CommandLine|contains: " stop"
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate sub processes started by Manage Engine ServiceDesk Pro
level: high
license: DRL-1.1
related:
- id: cea2b7ea-792b-405f-95a1-b903ea06458f
type: derived