Mint Sandstorm - Log4J Wstomcat Process Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•23

Detects the execution of processes where the parent process is 'ws_tomcatservice.exe', excluding 'repadmin.exe'. This activity has been observed in campaigns attributed to Mint Sandstorm, specifically leveraging Log4J vulnerabilities.