Java process spawns shell/cmd child (log4j FOIS deserialization RCE)

Georgios Maragos@Gmarak

•updated Aug 27, 2026•4•0•13

Detects instances where a Java process spawns a shell (cmd.exe, powershell.exe, sh, or bash) that executes suspicious commands often associated with remote code execution (RCE) patterns like those seen in Log4j exploitation. The rule excludes common Java-based build tools to reduce noise.