Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Java service

title: "Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Java service"
id: 25ca5b6e-674d-4a85-95d7-3b45671fd1e7
status: test
description: This rule flags Windows process creation events where the parent is the ManageEngine ServiceDesk Plus Java web service (java.exe under the ServiceDesk directory) spawning specific command-line and scripting tools. Such activity is notable because compromised hosts often use these utilities to execute payloads, stage data, or perform reconnaissance via child processes. The detection relies on process creation telemetry including ParentImage, Image, and CommandLine to identify the parent-child relationship and exclude a specific benign network service command pattern.
references:
  - https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/
  - https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py
  - https://blog.viettelcybersecurity.com/saml-show-stopper/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_java_manageengine_susp_child_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2023-01-18
modified: 2023-08-29
tags:
  - attack.command-and-control
  - attack.t1102
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains|all:
      - \ManageEngine\ServiceDesk\
      - \java.exe
    Image|endswith:
      - \AppVLP.exe
      - \bash.exe
      - \bitsadmin.exe
      - \calc.exe
      - \certutil.exe
      - \cscript.exe
      - \curl.exe
      - \forfiles.exe
      - \mftrace.exe
      - \mshta.exe
      - \net.exe
      - \net1.exe
      - \notepad.exe
      - \powershell.exe
      - \pwsh.exe
      - \query.exe
      - \reg.exe
      - \schtasks.exe
      - \scrcons.exe
      - \sh.exe
      - \systeminfo.exe
      - \whoami.exe
      - \wmic.exe
      - \wscript.exe
  filter_main_net:
    Image|endswith:
      - \net.exe
      - \net1.exe
    CommandLine|contains: " stop"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate sub processes started by Manage Engine ServiceDesk Pro
level: high
license: DRL-1.1
related:
  - id: cea2b7ea-792b-405f-95a1-b903ea06458f
    type: derived