windows_java_spawning_shells.yml

name: Windows Java Spawning Shells
id: 28c81306-5c47-11ec-bfea-acde48001122
version: 10
date: '2025-04-28'
author: Michael Haag, Splunk
status: experimental
type: TTP
description: The following analytic identifies instances where java.exe or w3wp.exe
  spawns a Windows shell, such as cmd.exe or powershell.exe. This detection leverages
  data from Endpoint Detection and Response (EDR) agents, focusing on process and
  parent process relationships. This activity is significant as it may indicate exploitation
  attempts, such as those related to CVE-2021-44228 (Log4Shell). If confirmed malicious,
  attackers could execute arbitrary commands, potentially leading to system compromise,
  data exfiltration, or further lateral movement within the network.
data_source:
- Sysmon EventID 1
- Windows Event Log Security 4688
- CrowdStrike ProcessRollup2
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=java.exe
  OR Processes.parent_process_name=w3wp.exe `windows_shells` by Processes.action Processes.dest
  Processes.original_file_name Processes.parent_process Processes.parent_process_exec
  Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
  Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid
  Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name
  Processes.process_path Processes.user Processes.user_id Processes.vendor_product
  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `windows_java_spawning_shells_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection
  and Response (EDR) agents. These agents are designed to provide security-related
  telemetry from the endpoints where the agent is installed. To implement this search,
  you must ingest logs that contain the process GUID, process name, and parent process.
  Additionally, you must ingest complete command-line executions. These logs must
  be processed using the appropriate Splunk Technology Add-ons that are specific to
  the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
  data model. Use the Splunk Common Information Model (CIM) to normalize the field
  names and speed up the data modeling process.
known_false_positives: Filtering may be required on internal developer build systems
  or classify assets as web facing and restrict the analytic based on that.
references:
- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
- https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/
- https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py
- https://blog.viettelcybersecurity.com/saml-show-stopper/
- https://www.horizon3.ai/manageengine-cve-2022-47966-iocs/
rba:
  message: An instance of $parent_process_name$ spawning $process_name$ was identified
    on endpoint $dest$ spawning a Windows shell, potentially indicative of exploitation.
  risk_objects:
  - field: dest
    type: system
    score: 40
  threat_objects:
  - field: parent_process_name
    type: parent_process_name
  - field: process_name
    type: process_name
tags:
  analytic_story:
  - Log4Shell CVE-2021-44228
  - SysAid On-Prem Software CVE-2023-47246 Vulnerability
  - Cleo File Transfer Software
  - SAP NetWeaver Exploitation
  asset_type: Endpoint
  cve:
  - CVE-2021-44228
  - CVE-2022-47966
  mitre_attack_id:
  - T1190
  - T1133
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: endpoint