Detection rules › Splunk
Suspicious process Spawned by Java (Windows Event Log)
Detect Java Spawning suspicious processes. This could indicate successful execution of vulnerabilities such as log4j CVE-2021-44228
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1203 Exploitation for Client Execution |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '8445.10630'
title: Suspicious process Spawned by Java
description: 'Detect Java Spawning suspicious processes. This could indicate successful
execution of vulnerabilities such as log4j CVE-2021-44228. - Threat Actor Association:
Evilnum, Volt Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) "java.exe" ("powershell.exe" OR "cmd.exe" OR "AppInstaller.exe"
OR "Bitsadmin.exe" OR "CertOC.exe" OR "CertReq.exe" OR "cmdl32.exe" OR "Control.exe"
OR "Cscript.exe" OR "Desktopimgdownldr.exe" OR "Diantz.exe" OR "Esentutl.exe" OR
"Eventvwr.exe" OR "Expand.exe" OR "Extrac32.exe" OR "Findstr.exe" OR "Finger.exe"
OR "Ftp.exe" OR "GfxDownloadWrapper.exe" OR "Hh.exe" OR "IMEWDBLD.exe" OR "Ieexec.exe"
OR "Installutil.exe" OR "Makecab.exe" OR "MpCmdRun.exe" OR "Mshta.exe" OR "Msiexec.exe"
OR "OneDriveStandaloneUpdater.exe" OR "PrintBrm.exe" OR "Regasm.exe" OR "Regsvr32.exe"
OR "Replace.exe" OR "Rundll32.exe" OR "Sc.exe" OR "Schtasks.exe" OR "Wmic.exe" OR
"Wscript.exe" OR "Xwizard.exe" OR "Excel.exe" OR "Powerpnt.exe" OR "Squirrel.exe"
OR "Winword.exe" OR "Wsl.exe" OR "nslookup.exe" OR "Certutil.exe") | table _time,
host, user event_id, parent_*, process_*, process, signature_id | bin span=1s |
stats values(*) as * by _time, host | where match(parent_process_name,"(?i)java\.exe") '
techniques:
- execution:exploitation for client execution
technique_id:
- T1203
data_category:
- Windows event logs
references:
- https://blog.qualys.com/vulnerabilities-threat-research/2021/12/14/log4shell-exploit-detection-and-response-with-qualys-multi-vector-edr
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) "java.exe" ("powershell.exe" OR "cmd.exe" OR "AppInstaller.exe" OR "Bitsadmin.exe" OR "CertOC.exe" OR "CertReq.exe" OR "cmdl32.exe" OR "Control.exe" OR "Cscript.exe" OR "Desktopimgdownldr.exe" OR "Diantz.exe" OR "Esentutl.exe" OR "Eventvwr.exe" OR "Expand.exe" OR "Extrac32.exe" OR "Findstr.exe" OR "Finger.exe" OR "Ftp.exe" OR "GfxDownloadWrapper.exe" OR "Hh.exe" OR "IMEWDBLD.exe" OR "Ieexec.exe" OR "Installutil.exe" OR "Makecab.exe" OR "MpCmdRun.exe" OR "Mshta.exe" OR "Msiexec.exe" OR "OneDriveStandaloneUpdater.exe" OR "PrintBrm.exe" OR "Regasm.exe" OR "Regsvr32.exe" OR "Replace.exe" OR "Rundll32.exe" OR "Sc.exe" OR "Schtasks.exe" OR "Wmic.exe" OR "Wscript.exe" OR "Xwizard.exe" OR "Excel.exe" OR "Powerpnt.exe" OR "Squirrel.exe" OR "Winword.exe" OR "Wsl.exe" OR "nslookup.exe" OR "Certutil.exe")
Stage 2: table
| table _time, host, user event_id, parent_*, process_*, process, signature_id
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: where
| where match(parent_process_name,"(?i)java\.exe")
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
parent_process_name | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "java.exe" |
| 1 | "powershell.exe" |
| 1 | "cmd.exe" |
| 1 | "AppInstaller.exe" |
| 1 | "Bitsadmin.exe" |
| 1 | "CertOC.exe" |
| 1 | "CertReq.exe" |
| 1 | "cmdl32.exe" |
| 1 | "Control.exe" |
| 1 | "Cscript.exe" |
| 1 | "Desktopimgdownldr.exe" |
| 1 | "Diantz.exe" |
| 1 | "Esentutl.exe" |
| 1 | "Eventvwr.exe" |
| 1 | "Expand.exe" |
| 1 | "Extrac32.exe" |
| 1 | "Findstr.exe" |
| 1 | "Finger.exe" |
| 1 | "Ftp.exe" |
| 1 | "GfxDownloadWrapper.exe" |
| 1 | "Hh.exe" |
| 1 | "IMEWDBLD.exe" |
| 1 | "Ieexec.exe" |
| 1 | "Installutil.exe" |
| 1 | "Makecab.exe" |
| 1 | "MpCmdRun.exe" |
| 1 | "Mshta.exe" |
| 1 | "Msiexec.exe" |
| 1 | "OneDriveStandaloneUpdater.exe" |
| 1 | "PrintBrm.exe" |
| 1 | "Regasm.exe" |
| 1 | "Regsvr32.exe" |
| 1 | "Replace.exe" |
| 1 | "Rundll32.exe" |
| 1 | "Sc.exe" |
| 1 | "Schtasks.exe" |
| 1 | "Wmic.exe" |
| 1 | "Wscript.exe" |
| 1 | "Xwizard.exe" |
| 1 | "Excel.exe" |
| 1 | "Powerpnt.exe" |
| 1 | "Squirrel.exe" |
| 1 | "Winword.exe" |
| 1 | "Wsl.exe" |
| 1 | "nslookup.exe" |
| 1 | "Certutil.exe" |