Suspicious SysAidServer Child Processes via Java on Windows

Flags SysAidServer process spawning java.exe/javaw.exe on Windows to surface likely suspicious execution.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-08-26
Updated: 2026-07-31

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1210Exploitation of Remote Services
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows process creation events where the parent process is java.exe or javaw.exe and the parent command line contains the string "SysAidServer". It highlights cases where Java-spawned child processes are initiated in the context of SysAidServer, which may indicate abuse of SysAidServer execution pathways. The detection relies on process creation telemetry, specifically parent image and parent command line content.

Reporting behind it

Related detections9 linkedT1210 — drag to rearrange

Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com

Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)

Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests

Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters

Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe

Windows MSExchange Management events indicating likely MS Exchange RCE CVE-2021-42321 exploitation

Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)

Windows Zerologon Exploitation Attempts via Mimikatz or Tools from Kali Host

Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)

Suspicious SysAidServer Child Processes via Java on Windows

Pivot detection · T1210 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-sysaidserver-spawns-suspicious-java-child-processes-60bfeac3

title: Suspicious SysAidServer Child Processes via Java on Windows
id: 03f1748a-e88c-4b3b-8636-7f8de54b4a58
status: test
description: This rule matches Windows process creation events where the parent process is java.exe or javaw.exe and the parent command line contains the string "SysAidServer". It highlights cases where Java-spawned child processes are initiated in the context of SysAidServer, which may indicate abuse of SysAidServer execution pathways. The detection relies on process creation telemetry, specifically parent image and parent command line content.
references:
  - https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_java_sysaidserver_susp_child_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-26
tags:
  - attack.lateral-movement
  - attack.t1210
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \java.exe
      - \javaw.exe
    ParentCommandLine|contains: SysAidServer
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 60bfeac3-0d35-4302-8efb-1dd16f715bc6
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL