Detection rules › Splunk

Suspicious process Spawned by Java (Windows Event Log)

Group by
_time, host
Source
github.com/anvilogic-forge/armory

Detect Java Spawning suspicious processes. This could indicate successful execution of vulnerabilities such as log4j CVE-2021-44228

MITRE ATT&CK coverage

References

Event coverage

Rule body yaml

id: '8445.10630'
title: Suspicious process Spawned by Java
description: 'Detect Java Spawning suspicious processes. This could indicate successful
  execution of vulnerabilities such as log4j CVE-2021-44228. - Threat Actor Association:
  Evilnum, Volt Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "java.exe" ("powershell.exe" OR "cmd.exe" OR "AppInstaller.exe"
  OR "Bitsadmin.exe" OR "CertOC.exe" OR "CertReq.exe" OR "cmdl32.exe" OR "Control.exe"
  OR "Cscript.exe" OR "Desktopimgdownldr.exe" OR "Diantz.exe" OR "Esentutl.exe" OR
  "Eventvwr.exe" OR "Expand.exe" OR "Extrac32.exe" OR "Findstr.exe" OR "Finger.exe"
  OR "Ftp.exe" OR "GfxDownloadWrapper.exe" OR "Hh.exe" OR "IMEWDBLD.exe" OR "Ieexec.exe"
  OR "Installutil.exe" OR "Makecab.exe" OR "MpCmdRun.exe" OR "Mshta.exe" OR "Msiexec.exe"
  OR "OneDriveStandaloneUpdater.exe" OR "PrintBrm.exe" OR "Regasm.exe" OR "Regsvr32.exe"
  OR "Replace.exe" OR "Rundll32.exe" OR "Sc.exe" OR "Schtasks.exe" OR "Wmic.exe" OR
  "Wscript.exe" OR "Xwizard.exe" OR "Excel.exe" OR "Powerpnt.exe" OR "Squirrel.exe"
  OR "Winword.exe" OR "Wsl.exe" OR "nslookup.exe" OR "Certutil.exe") | table _time,
  host, user event_id, parent_*, process_*, process, signature_id | bin span=1s |
  stats values(*) as * by _time, host | where match(parent_process_name,"(?i)java\.exe") '
techniques:
- execution:exploitation for client execution
technique_id: 
- T1203
data_category:
- Windows event logs
references:
- https://blog.qualys.com/vulnerabilities-threat-research/2021/12/14/log4shell-exploit-detection-and-response-with-qualys-multi-vector-edr

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) "java.exe" ("powershell.exe" OR "cmd.exe" OR "AppInstaller.exe" OR "Bitsadmin.exe" OR "CertOC.exe" OR "CertReq.exe" OR "cmdl32.exe" OR "Control.exe" OR "Cscript.exe" OR "Desktopimgdownldr.exe" OR "Diantz.exe" OR "Esentutl.exe" OR "Eventvwr.exe" OR "Expand.exe" OR "Extrac32.exe" OR "Findstr.exe" OR "Finger.exe" OR "Ftp.exe" OR "GfxDownloadWrapper.exe" OR "Hh.exe" OR "IMEWDBLD.exe" OR "Ieexec.exe" OR "Installutil.exe" OR "Makecab.exe" OR "MpCmdRun.exe" OR "Mshta.exe" OR "Msiexec.exe" OR "OneDriveStandaloneUpdater.exe" OR "PrintBrm.exe" OR "Regasm.exe" OR "Regsvr32.exe" OR "Replace.exe" OR "Rundll32.exe" OR "Sc.exe" OR "Schtasks.exe" OR "Wmic.exe" OR "Wscript.exe" OR "Xwizard.exe" OR "Excel.exe" OR "Powerpnt.exe" OR "Squirrel.exe" OR "Winword.exe" OR "Wsl.exe" OR "nslookup.exe" OR "Certutil.exe")

Stage 2: table

| table _time, host, user event_id, parent_*, process_*, process, signature_id

Stage 3: bucket

| bin span=1s

Stage 4: stats

| stats values(*) as * by _time, host

Stage 5: where

| where match(parent_process_name,"(?i)java\.exe")

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 4688 corpus 313 (splunk 283, kusto 30)
parent_process_namematch
  • "(?i)java\.exe"

Search terms

Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.

StageTerm
1TERM
1"<EventID>4688<"
1"java.exe"
1"powershell.exe"
1"cmd.exe"
1"AppInstaller.exe"
1"Bitsadmin.exe"
1"CertOC.exe"
1"CertReq.exe"
1"cmdl32.exe"
1"Control.exe"
1"Cscript.exe"
1"Desktopimgdownldr.exe"
1"Diantz.exe"
1"Esentutl.exe"
1"Eventvwr.exe"
1"Expand.exe"
1"Extrac32.exe"
1"Findstr.exe"
1"Finger.exe"
1"Ftp.exe"
1"GfxDownloadWrapper.exe"
1"Hh.exe"
1"IMEWDBLD.exe"
1"Ieexec.exe"
1"Installutil.exe"
1"Makecab.exe"
1"MpCmdRun.exe"
1"Mshta.exe"
1"Msiexec.exe"
1"OneDriveStandaloneUpdater.exe"
1"PrintBrm.exe"
1"Regasm.exe"
1"Regsvr32.exe"
1"Replace.exe"
1"Rundll32.exe"
1"Sc.exe"
1"Schtasks.exe"
1"Wmic.exe"
1"Wscript.exe"
1"Xwizard.exe"
1"Excel.exe"
1"Powerpnt.exe"
1"Squirrel.exe"
1"Winword.exe"
1"Wsl.exe"
1"nslookup.exe"
1"Certutil.exe"