Windows SysAidServer Spawns Suspicious Java Child Processes

Flags SysAidServer process spawning java.exe/javaw.exe on Windows to surface likely suspicious execution.

FreeUnreviewedSigmamediumv1

windows-sysaidserver-spawns-suspicious-java-child-processes-60bfeac3

title: Windows SysAidServer Spawns Suspicious Java Child Processes
id: 03f1748a-e88c-4b3b-8636-7f8de54b4a58
status: test
description: This rule identifies process creation events where a SysAidServer-related parent process starts a child process whose executable ends with java.exe or javaw.exe. Spawning Java from SysAidServer can indicate malicious payload execution or command chaining rather than normal service behavior. It relies on Windows process creation telemetry, specifically the parent image and parent command line contents.
references:
  - https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_java_sysaidserver_susp_child_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-26
tags:
  - attack.lateral-movement
  - attack.t1210
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    ParentCommandLine|contains: SysAidServer
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 60bfeac3-0d35-4302-8efb-1dd16f715bc6
    type: derived

What it detects

This rule identifies process creation events where a SysAidServer-related parent process starts a child process whose executable ends with java.exe or javaw.exe. Spawning Java from SysAidServer can indicate malicious payload execution or command chaining rather than normal service behavior. It relies on Windows process creation telemetry, specifically the parent image and parent command line contents.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.