Ivanti EPMM Tomcat/Java Spawning Shell or Sliver

Daniel Jeremiah@daniyyell

•updated Feb 13, 2026•0•20

This rule detects suspicious process creation patterns where a Java or Tomcat process (common in Ivanti EPMM) spawns a command shell (cmd.exe, bash, sh) or a process containing 'sliver' or 'implant' in its command line. This behavior is indicative of potential Remote Code Execution (RCE) abuse, particularly in the context of Ivanti EPMM vulnerabilities.