TeamCity server spawns unexpected child process (CVE-2026-63077)

Thiru N@Iamthiru

•updated Sep 5, 2026•7•0•10

This rule detects potentially unauthorized process executions (such as shells, network utilities, or enumeration tools) originating from TeamCity server processes (java.exe, javaw.exe). It filters out known TeamCity build agent or maintenance activities to highlight deviations from standard server behavior.