Java (Apache ActiveMQ) Spawning CertUtil Download (CVE-2023-46604 Exploitation)
The rule detects instances where a Java process (java.exe or javaw.exe) spawns certutil.exe with command-line arguments indicating a URL download. This specific pattern is associated with the exploitation of CVE-2023-46604 in Apache ActiveMQ, where certutil.exe is used to download a payload. The detection logic looks for the parent process being 'java.exe' or 'javaw.exe', the child process being 'certutil.exe', and the command line of 'certutil.exe' containing both '-urlcache' and 'http', which are indicative of a file download from a URL.
Sigma
