Exploit Activemq Springxml Certutil Download

Daniel Jeremiah@daniyyell

•updated Feb 25, 2026•1•0•37

This rule detects suspicious Spring bean XML content, specifically looking for indicators related to the exploitation of Apache ActiveMQ CVE-2023-46604. It targets XML payloads that attempt to execute commands using 'ProcessBuilder' and download files via 'certutil -urlcache' from an HTTP source, consistent with observed attack patterns.