Suspicious Child Process Spawned by Java on Linux

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•21

Detects when a Java process spawns suspicious child processes, specifically various shell interpreters (sh, bash, dash, ksh, zsh, csh, fish), or common command-line tools like curl, wget, and python. This behavior can indicate a Java application being exploited to execute arbitrary commands on the system.