JARLEASH Java backdoor spawning FTP/SFTP or Netcat services
Detects instances where a Java process (java.exe/java) spawns common network utilities such as FTP, SFTP, or Netcat. This activity is often associated with exploitation of Java-based applications, potentially indicating post-exploitation behavior such as data exfiltration or manual command and control communication.
Microsoft Sentinel (KQL)
