Java Runtime Execution from ProgramData

Duo Tech@duotech

•updated Jun 4, 2026•0•0•13

Detects the execution of the windowless Java runtime (javaw.exe) originating from the C:\ProgramData\ directory. Threat actors, such as those deploying Nimbus RAT, often drop a bundled Java Runtime Environment (JRE/JDK) in ProgramData to evade detections that monitor standard Java installation paths.