Suspicious Java Children Processes

Title: Suspicious Java Children Processes
Status: test
Description:Detects java process spawning suspicious children
References:
  -https://www.tecmint.com/different-types-of-linux-shells/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-03
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: linux

Detection:
  selection:
    ParentImage|endswith: '/java'
    CommandLine|contains:
      -'/bin/sh'
      -'bash'
      -'dash'
      -'ksh'
      -'zsh'
      -'csh'
      -'fish'
      -'curl'
      -'wget'
      -'python'

  condition:selection
Falsepositives:
  -Unknown
Level: high