Windows Java Spawning Shells

This analytic identifies instances where `java.exe` or `tomcat.exe` spawns a Windows shell, such as `cmd.exe` or `powershell.exe`. This activity is significant as it may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell) or CVE-2022-47966. If confirmed malicious, attackers could execute arbitrary commands, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.