All Detections

ActiveMQ Java Process Starts Command Shell Or PowerShell

avatar
Daniel Jeremiah@daniyyell
updated Feb 27, 2026035

Detects a Java process starting cmd or PowerShell. On an ActiveMQ server this can indicate that someone is running commands after exploiting the service.

Sigma