Process Execution Error In JVM Based Application

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•25

Detects process execution related exceptions in JVM based applications, which can often indicate Remote Code Execution (RCE) attempts. The rule specifically looks for keywords like 'Cannot run program', 'java.lang.ProcessImpl', and 'java.lang.ProcessBuilder' in application error logs.