Potential Java Service Exploitation via Suspicious Child Process

  1[metadata]
  2creation_date = "2021/12/10"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/08/26"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies a Java process that accepts an inbound network connection and then spawns a suspicious child process. This
 11may indicate exploitation of a Java service that runs attacker-controlled code, such as one that deserializes untrusted
 12objects.
 13"""
 14from = "now-9m"
 15index = ["auditbeat-*", "logs-endpoint.events.*"]
 16language = "eql"
 17license = "Elastic License v2"
 18name = "Potential Java Service Exploitation via Suspicious Child Process"
 19references = [
 20    "https://www.lunasec.io/docs/blog/log4j-zero-day/",
 21    "https://github.com/christophetd/log4shell-vulnerable-app",
 22    "https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf",
 23    "https://www.elastic.co/security-labs/detecting-log4j2-with-elastic-security",
 24    "https://www.elastic.co/security-labs/analysis-of-log4shell-cve-2021-45046",
 25    "https://archive.ph/Xowgn",
 26]
 27risk_score = 73
 28rule_id = "c3f5e1d8-910e-43b4-8d44-d748e498ca86"
 29severity = "high"
 30tags = [
 31    "Domain: Endpoint",
 32    "OS: Linux",
 33    "OS: macOS",
 34    "Use Case: Threat Detection",
 35    "Tactic: Execution",
 36    "Use Case: Vulnerability",
 37    "Data Source: Elastic Defend",
 38    "Resources: Investigation Guide",
 39]
 40type = "eql"
 41
 42query = '''
 43sequence by host.id with maxspan=5s
 44 [network where event.action == "connection_accepted" and network.direction == "ingress" and
 45
 46  process.name : "java" and
 47  destination.port < 49152  and source.port >= 32768] by process.pid
 48 [process where event.type == "start" and
 49
 50  /* Suspicious JAVA child process */
 51  process.parent.name : "java" and
 52  process.name : (
 53    "sh", "bash", "dash", "ksh", "tcsh", "zsh", "ash",  "mksh", "busybox",
 54    "curl", "wget", "perl*", "python*", "ruby*", "php*", "lua*", "socat",
 55    "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
 56    "nc.traditional", "nohup", "setsid", "disown", "hostname", "whoami", "id"
 57  ) and
 58    not process.command_line like~ (
 59      "bash -c ulimit -u",
 60      "bash /opt/flutter/bin/flutter*",
 61      "bash -c echo $$",
 62      "/bin/bash /opt/python3/bin/jira*",
 63      "/bin/sh -c env LC_ALL=C /usr/sbin/lpc status*"
 64    )] by process.parent.pid
 65'''
 66note = """## Triage and analysis
 67
 68> **Disclaimer**:
 69> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 70
 71### Investigating Potential Java Service Exploitation via Suspicious Child Process
 72
 73Some Java services accept inbound connections and deserialize untrusted objects, such as a leftover Log4j socket or collector that rebuilds serialized `LogEvent` objects through `FilteredObjectInputStream`. If that path can be reached, an attacker can send a crafted payload to the listening port and get the JVM to run attacker-controlled code. This rule looks for a Java process that accepts an inbound connection on a service port from an ephemeral source port, then quickly starts a suspicious child process (shell, interpreter, curl, or wget) whose working directory is under `/opt`. That sequence is consistent with remote code execution against a Java listener rather than a normal outbound application callback.
 74
 75### Possible investigation steps
 76
 77- Confirm the inbound `connection_accepted` event: Java was the accepting process, `network.direction` is ingress, the destination port is a service port (below 49152), and the source port is ephemeral (32768 or higher on Linux; 49152 or higher is typical on macOS).
 78- Identify the source IP and determine whether it is expected to talk to this Java service. Internal sources still matter; a collector or socket server exposed only on a private network can still be used for lateral movement.
 79- Review the child process that started within a few seconds of the accepted connection. Check `process.name`, `process.command_line`, `process.working_directory`, and the parent/child PID relationship to Java.
 80- Inspect the Java process command line and working directory to see which application accepted the connection (for example a service under `/opt`) and whether it is a known listener that deserializes input.
 81- Look for follow-on activity on the same host after the child process: additional shells, file writes under `/tmp` or `/opt`, new outbound connections, or persistence changes.
 82- Correlate with other alerts on the same host or user around the same time to see whether this is isolated or part of a broader intrusion.
 83
 84### False positive analysis
 85
 86- Java services installed may spawn shells or interpreters during install, upgrade, health checks, or administrative scripts. Confirm whether the child command line matches a known maintenance pattern before treating the alert as malicious.
 87- Some already-excluded patterns include Flutter tooling, Jira helper scripts, and trivial `bash -c` probes such as `ulimit` or `echo $$`. Add similar exceptions for other trusted `/opt` applications when the parent Java process and command line are stable.
 88- Development or lab collectors that intentionally accept serialized Java objects will match this rule if they also start a shell. Restrict those hosts or exclude the specific service path if that activity is expected.
 89- Containerized or non-`/opt` Java applications are outside this rule's working-directory constraint and should not be tuned here; investigate those with a broader hunt if needed.
 90
 91### Response and remediation
 92
 93- Isolate the affected host from the network to stop further inbound exploitation and limit lateral movement.
 94- Stop the suspicious child processes and, if exploitation is confirmed, stop the Java listener that accepted the connection until it can be patched or removed.
 95- Capture the Java process command line, listening port, child process command line, and inbound source IP for scoping.
 96- Hunt for the same source IP, the same Java service path, and similar child processes on other hosts.
 97- Remove or disable unused Java socket servers, collectors, or sample bridges that deserialize untrusted input. Patch remaining Java applications and apply a JVM-wide serialization filter where deserialization cannot be avoided.
 98- Restore from a known-good backup if unauthorized files, persistence, or additional malware are found.
 99- Escalate to the security operations center or incident response team if the inbound source, child process, or follow-on activity indicates a successful compromise."""
100
101
102[[rule.threat]]
103framework = "MITRE ATT&CK"
104
105[[rule.threat.technique]]
106id = "T1059"
107name = "Command and Scripting Interpreter"
108reference = "https://attack.mitre.org/techniques/T1059/"
109
110[[rule.threat.technique.subtechnique]]
111id = "T1059.004"
112name = "Unix Shell"
113reference = "https://attack.mitre.org/techniques/T1059/004/"
114
115[[rule.threat.technique.subtechnique]]
116id = "T1059.006"
117name = "Python"
118reference = "https://attack.mitre.org/techniques/T1059/006/"
119
120[[rule.threat.technique.subtechnique]]
121id = "T1059.007"
122name = "JavaScript"
123reference = "https://attack.mitre.org/techniques/T1059/007/"
124
125[[rule.threat.technique]]
126id = "T1203"
127name = "Exploitation for Client Execution"
128reference = "https://attack.mitre.org/techniques/T1203/"
129
130[rule.threat.tactic]
131id = "TA0002"
132name = "Execution"
133reference = "https://attack.mitre.org/tactics/TA0002/"
134
135[[rule.threat]]
136framework = "MITRE ATT&CK"
137
138[[rule.threat.technique]]
139id = "T1190"
140name = "Exploit Public-Facing Application"
141reference = "https://attack.mitre.org/techniques/T1190/"
142
143[rule.threat.tactic]
144id = "TA0001"
145name = "Initial Access"
146reference = "https://attack.mitre.org/tactics/TA0001/"