Ghidra 12.1.2 ACE via Malicious Project or Script — Unexpected Child Process

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

This rule detects instances where the Ghidra reverse engineering suite (or associated Java processes running Ghidra components) initiates suspicious child processes. This behavior is considered anomalous as standard reverse engineering activities in Ghidra should not require the execution of system administrative tools, interpreters, or networking utilities, which may indicate an attacker using a compromised development environment to launch secondary payloads or tools.