Shell Execution via Java Parent Process

[rule]
description = """
This rule detects shell executions spawned by Java parent processes in specific user directories, excluding Oracle
SYSMAN schema and Enterprise Management Daemon (EMD) related working directories. Such behavior may indicate
exploitation attempts or command execution.
"""
id = "565c5297-16f2-47aa-8537-2982475d30b2"
license = "Elastic License v2"
name = "Shell Execution via Java Parent Process"
os_list = ["linux"]
reference = [
    "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html",
    "https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/",
]
version = "1.0.2"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.name == "java" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and
process.working_directory like~ "/u0?/*" and user.id == 54321 and not (
  process.working_directory like~ ("/u0*/*/sysman/emd", "/u0?/app/oracle/product/*/dbhome_*", "/u0?/app/oracle/product/*/db_*", "/u01/app/oracle/crsdata/*/cvu/cvutrc") or
  process.command_line == "/bin/sh -c /u01/client_1/client/scheduler/execution_agent/bin/jssu" or
  (process.working_directory == "/u01/domains/bi" and process.command_line like "*weblogic.Server*") or
  process.args like ("/tmp/CVU_19_*/exectask.sh*", "java -cp*/u01/MW/bi/modules/oracle.bi.sysman/scripts/../env/stdout_config.properties*") or
  (
    process.parent.executable like "/u01/app/*grid/jdk/bin/java" and
    process.args like ("/bin/rpm*", "/u01/app/grid/bin/*", "/bin/uname -m", "/u01/app/oracle/product/*/bin/*")
  ) or
  (
    process.parent.executable like "/u01/app/oracle/*/jdk/*bin/java" and
    process.args like ("/u01/app/oracle/product/*/bin/*", "/usr/sbin/lpc*", "stty*")
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"


[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"