Sigma detection rules, expert-reviewed

Malicious ActiveMQ CVE-2023-46604 Payload Download via curl or wget

This rule detects curl or wget fetching the Kinsing exploitation Spring context files poc.xml or linux-poc.xml. During ActiveMQ CVE-2023-46604 exploitation the broker is coerced into loading a remote XML that pulls the next stage, so these filenames in a download command indicate active exploitation.

Suspicious Shell or Installer Spawned by ActiveMQ Java Process

This rule detects a Java process spawning cmd, msiexec, or PowerShell, the exploitation chain of Apache ActiveMQ CVE-2023-46604 where the broker Java process executed attacker commands. A Java server process launching Windows shells or installers indicates remote code execution against the exposed service.

Possible Apache ActiveMQ RCE via Jolokia addNetworkConnector (via webserver)

This rule detects HTTP requests to the ActiveMQ Jolokia API that invoke the addNetworkConnector broker operation with a remote xbean configuration URI. This corresponds to CVE-2026-34197 remote code execution where the broker loads an attacker hosted Spring bean. Administrators rarely add network connectors that reference external HTTP xbean configs.

Suspicious Shell Spawned by ActiveMQ Java Process

This rule detects a Linux shell being spawned as a child of an Apache ActiveMQ Java process, the exploitation pattern of CVE-2023-46604 remote code execution. Attackers trigger the deserialization flaw to run shell commands and fetch second-stage payloads. A Java broker process launching an interactive shell is a clear post-exploitation signal.

Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)

This rule detects an ActiveMQ Java process spawning PowerShell that downloads a remote payload. Exploitation of CVE-2023-46604 caused the ActiveMQ java process to launch PowerShell IEX and DownloadFile commands to stage ransomware.