Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Process Execution Error In JVM Based Application

Detects process execution related exceptions in JVM based apps, often relates to RCE

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Moti HarmatsCreated Sat Feb 11d65f37da-a26a-48f8-8159-3dde96680ad2application
Log Source
jvmapplication
Productjvm← raw: jvm
Categoryapplication← raw: application

Definition

Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)

Detection Logic
Detection Logic1 selector
detection:
    keywords:
        - 'Cannot run program'
        - 'java.lang.ProcessImpl'
        - 'java.lang.ProcessBuilder'
    condition: keywords
False Positives

Application bugs

References
1
Resolving title…
wix.engineering
MITRE ATT&CK
Rule Metadata
Rule ID
d65f37da-a26a-48f8-8159-3dde96680ad2
Status
test
Level
high
Type
Detection
Created
Sat Feb 11
Author
Moti Harmats
Path
rules/application/jvm/java_rce_exploitation_attempt.yml
Raw Tags
attack.initial-accessattack.t1190
View on GitHub