Java Spawning Child Process by Unique Child Process Name - Potential Exploitation Activity

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Identifies child processes spawned by Java, ordered by the most unique parent/child pair first, to surface outliers that may indicate exploitation. Legitimate results are expected. Inspired by the Log4Shell, Spring4Shell and Text4Shell vulnerabilities.

Attribute	Value
Type	Hunting Query
Solution	Intel471
ID	668a47ab-f437-4a63-90a5-912b118dc264
Tactics	DefenseEvasion, InitialAccess
Techniques	T1190, T1202
Required Connectors	SecurityEvents, WindowsSecurityEvents
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
SecurityEvent	ParentProcessName contains "java"	✓	✓	✓

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries · Back to Intel471