Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)

title: "Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)"
id: 25ca5b6e-674d-4a85-95d7-3b45671fd1e7
status: test
description: This rule identifies suspicious Windows process creations where the parent process path contains both the ManageEngine ServiceDesk directory and java.exe, and the resulting child process is one of several common command and scripting utilities (e.g., PowerShell, cmd-related tools, certutil, mshta, wmic). Such behavior is frequently abused during exploitation or post-exploitation when an attacker uses the service context to run additional binaries. It relies on Windows process creation telemetry with parent image path, child image path, and child command-line text, including a specific exclusion for net.exe/net1.exe commands containing " stop".
references:
  - https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/
  - https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py
  - https://blog.viettelcybersecurity.com/saml-show-stopper/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_java_manageengine_susp_child_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2023-01-18
modified: 2023-08-29
tags:
  - attack.command-and-control
  - attack.t1102
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains|all:
      - \ManageEngine\ServiceDesk\
      - \java.exe
    Image|endswith:
      - \AppVLP.exe
      - \bash.exe
      - \bitsadmin.exe
      - \calc.exe
      - \certutil.exe
      - \cscript.exe
      - \curl.exe
      - \forfiles.exe
      - \mftrace.exe
      - \mshta.exe
      - \net.exe
      - \net1.exe
      - \notepad.exe
      - \powershell.exe
      - \pwsh.exe
      - \query.exe
      - \reg.exe
      - \schtasks.exe
      - \scrcons.exe
      - \sh.exe
      - \systeminfo.exe
      - \whoami.exe
      - \wmic.exe
      - \wscript.exe
  filter_main_net:
    Image|endswith:
      - \net.exe
      - \net1.exe
    CommandLine|contains: " stop"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate sub processes started by Manage Engine ServiceDesk Pro
level: high
license: DRL-1.1
related:
  - id: cea2b7ea-792b-405f-95a1-b903ea06458f
    type: derived