Ghidra 12.1.2 ACE — Unexpected Child Process from Ghidra JVM (exploitarium PoC)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•7

Detects arbitrary code execution attempts against Ghidra 12.1.2 by monitoring for suspicious child process spawning from the Ghidra JVM. The rule identifies instances where java.exe, running in a Ghidra-related context, launches unauthorized binary interpreters or tools such as powershell.exe, cmd.exe, or other shell utilities often used as post-exploitation payloads.