Runtime.exec from Java Deserialization of Log4jLogEvent$LogEventProxy

Georgios Maragos@Gmarak

•updated Aug 27, 2026•12•0•6

Detects suspicious child process creation (e.g., cmd.exe, powershell.exe) originating from Java applications where the command line contains indicators of deserialization vulnerabilities (e.g., FilteredObjectInputStream, Log4jLogEvent). This pattern is often associated with exploitation of Java applications to gain remote code execution.