khunt / Oracle SQLi -> Java stored proc -> cmd.exe
Detects instances where Java or Oracle-related processes (java.exe, oracle.exe, tnslsnr.exe) initiate suspicious command-line tools like cmd.exe or powershell.exe to execute commands typically associated with reconnaissance, such as whoami or tasklist. This is a strong indicator of post-exploitation activity where a compromised web server or database process is being used to conduct system discovery.
Microsoft Sentinel (KQL)
