Shell Process Spawned by Java.EXE
Detects when a shell process (bash, cmd, or PowerShell) is spawned by a Java executable. This activity can be indicative of exploitation, such as the Log4j vulnerability, where an attacker leverages a Java application to execute arbitrary commands on the underlying system. The rule filters out common CI build agent activities to reduce false positives.
Sigma
