Potential Java Service Exploitation via Suspicious Child Process

  1[metadata]
  2creation_date = "2021/12/10"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies a Java process that accepts an inbound network connection and then spawns a suspicious child process. This
 11may indicate exploitation of a Java service that runs attacker-controlled code, such as one that deserializes untrusted
 12objects.
 13"""
 14from = "now-9m"
 15index = ["auditbeat-*", "logs-endpoint.events.*"]
 16language = "eql"
 17license = "Elastic License v2"
 18name = "Potential Java Service Exploitation via Suspicious Child Process"
 19references = [
 20    "https://www.lunasec.io/docs/blog/log4j-zero-day/",
 21    "https://github.com/christophetd/log4shell-vulnerable-app",
 22    "https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf",
 23    "https://www.elastic.co/security-labs/detecting-log4j2-with-elastic-security",
 24    "https://www.elastic.co/security-labs/analysis-of-log4shell-cve-2021-45046",
 25    "https://archive.ph/Xowgn",
 26]
 27risk_score = 73
 28rule_id = "c3f5e1d8-910e-43b4-8d44-d748e498ca86"
 29severity = "high"
 30tags = [
 31    "Domain: Endpoint",
 32    "OS: Linux",
 33    "OS: macOS",
 34    "Use Case: Threat Detection",
 35    "Tactic: Execution",
 36    "Use Case: Vulnerability",
 37    "Data Source: Elastic Defend",
 38    "Resources: Investigation Guide",
 39    "Noise: High",
 40    "Performance: Normal",
 41    "Profile: Aggressive",
 42    "Threat: Vulnerability Exploit",
 43    "Rule Type: Event Correlation (EQL)",
 44    "Platform: Linux",
 45    "Platform: macOS",
 46]
 47type = "eql"
 48
 49query = '''
 50sequence by host.id with maxspan=5s
 51 [network where event.action == "connection_accepted" and network.direction == "ingress" and
 52
 53  process.name : "java" and
 54  destination.port < 49152  and source.port >= 32768] by process.pid
 55 [process where event.type == "start" and
 56
 57  /* Suspicious JAVA child process */
 58  process.parent.name : "java" and
 59  process.name : (
 60    "sh", "bash", "dash", "ksh", "tcsh", "zsh", "ash",  "mksh", "busybox",
 61    "curl", "wget", "perl*", "python*", "ruby*", "php*", "lua*", "socat",
 62    "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
 63    "nc.traditional", "nohup", "setsid", "disown", "hostname", "whoami", "id"
 64  ) and
 65    not process.command_line like~ (
 66      "bash -c ulimit -u",
 67      "bash /opt/flutter/bin/flutter*",
 68      "bash -c echo $$",
 69      "/bin/bash /opt/python3/bin/jira*",
 70      "/bin/sh -c env LC_ALL=C /usr/sbin/lpc status*"
 71    )] by process.parent.pid
 72'''
 73note = """## Triage and analysis
 74
 75> **Disclaimer**:
 76> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 77
 78### Investigating Potential Java Service Exploitation via Suspicious Child Process
 79
 80Some Java services accept inbound connections and deserialize untrusted objects, such as a leftover Log4j socket or collector that rebuilds serialized `LogEvent` objects through `FilteredObjectInputStream`. If that path can be reached, an attacker can send a crafted payload to the listening port and get the JVM to run attacker-controlled code. This rule looks for a Java process that accepts an inbound connection on a service port from an ephemeral source port, then quickly starts a suspicious child process (shell, interpreter, curl, or wget) whose working directory is under `/opt`. That sequence is consistent with remote code execution against a Java listener rather than a normal outbound application callback.
 81
 82### Possible investigation steps
 83
 84- Confirm the inbound `connection_accepted` event: Java was the accepting process, `network.direction` is ingress, the destination port is a service port (below 49152), and the source port is ephemeral (32768 or higher on Linux; 49152 or higher is typical on macOS).
 85- Identify the source IP and determine whether it is expected to talk to this Java service. Internal sources still matter; a collector or socket server exposed only on a private network can still be used for lateral movement.
 86- Review the child process that started within a few seconds of the accepted connection. Check `process.name`, `process.command_line`, `process.working_directory`, and the parent/child PID relationship to Java.
 87- Inspect the Java process command line and working directory to see which application accepted the connection (for example a service under `/opt`) and whether it is a known listener that deserializes input.
 88- Look for follow-on activity on the same host after the child process: additional shells, file writes under `/tmp` or `/opt`, new outbound connections, or persistence changes.
 89- Correlate with other alerts on the same host or user around the same time to see whether this is isolated or part of a broader intrusion.
 90
 91### False positive analysis
 92
 93- Java services installed may spawn shells or interpreters during install, upgrade, health checks, or administrative scripts. Confirm whether the child command line matches a known maintenance pattern before treating the alert as malicious.
 94- Some already-excluded patterns include Flutter tooling, Jira helper scripts, and trivial `bash -c` probes such as `ulimit` or `echo $$`. Add similar exceptions for other trusted `/opt` applications when the parent Java process and command line are stable.
 95- Development or lab collectors that intentionally accept serialized Java objects will match this rule if they also start a shell. Restrict those hosts or exclude the specific service path if that activity is expected.
 96- Containerized or non-`/opt` Java applications are outside this rule's working-directory constraint and should not be tuned here; investigate those with a broader hunt if needed.
 97
 98### Response and remediation
 99
100- Isolate the affected host from the network to stop further inbound exploitation and limit lateral movement.
101- Stop the suspicious child processes and, if exploitation is confirmed, stop the Java listener that accepted the connection until it can be patched or removed.
102- Capture the Java process command line, listening port, child process command line, and inbound source IP for scoping.
103- Hunt for the same source IP, the same Java service path, and similar child processes on other hosts.
104- Remove or disable unused Java socket servers, collectors, or sample bridges that deserialize untrusted input. Patch remaining Java applications and apply a JVM-wide serialization filter where deserialization cannot be avoided.
105- Restore from a known-good backup if unauthorized files, persistence, or additional malware are found.
106- Escalate to the security operations center or incident response team if the inbound source, child process, or follow-on activity indicates a successful compromise."""
107
108
109[[rule.threat]]
110framework = "MITRE ATT&CK"
111
112[[rule.threat.technique]]
113id = "T1059"
114name = "Command and Scripting Interpreter"
115reference = "https://attack.mitre.org/techniques/T1059/"
116
117[[rule.threat.technique.subtechnique]]
118id = "T1059.004"
119name = "Unix Shell"
120reference = "https://attack.mitre.org/techniques/T1059/004/"
121
122[[rule.threat.technique.subtechnique]]
123id = "T1059.006"
124name = "Python"
125reference = "https://attack.mitre.org/techniques/T1059/006/"
126
127[[rule.threat.technique.subtechnique]]
128id = "T1059.007"
129name = "JavaScript"
130reference = "https://attack.mitre.org/techniques/T1059/007/"
131
132[[rule.threat.technique]]
133id = "T1203"
134name = "Exploitation for Client Execution"
135reference = "https://attack.mitre.org/techniques/T1203/"
136
137[rule.threat.tactic]
138id = "TA0002"
139name = "Execution"
140reference = "https://attack.mitre.org/tactics/TA0002/"
141
142[[rule.threat]]
143framework = "MITRE ATT&CK"
144
145[[rule.threat.technique]]
146id = "T1190"
147name = "Exploit Public-Facing Application"
148reference = "https://attack.mitre.org/techniques/T1190/"
149
150[rule.threat.tactic]
151id = "TA0001"
152name = "Initial Access"
153reference = "https://attack.mitre.org/tactics/TA0001/"