ActiveMQ Exploit Leads to LockBit-style Ransomware Activity

Daniel Jeremiah@daniyyell

•updated Feb 25, 2026•1•0•84

This rule detects various stages of an attack chain, starting from an Apache ActiveMQ exploit (CVE-2023-46604) leading to LockBit-style ransomware. It identifies process creation anomalies (java.exe spawning certutil.exe for downloads), network connections to known Metasploit C2 infrastructure, the presence of specific ransomware file hashes, and attempts to clear Windows event logs, all indicative of the described attack scenario.