ActiveMQ Spawning CertUtil for Payload Download

Ethan Andrews@eandrews

•updated Feb 24, 2026•6•0•67

Detects the Java process, commonly associated with Apache ActiveMQ, spawning certutil.exe to download a file from a remote URL. This behavior is a strong indicator of initial compromise via vulnerabilities like CVE-2023-46604.