Detections

Analysis of Apache ActiveMQ Exploit Leads to LockBit Ransomware

Apache ActiveMQ RCE (CVE-2023-46604) Spawning LockBit

sigma · generated; parse required before publication

title: Apache ActiveMQ RCE (CVE-2023-46604) Spawning LockBit
description: Detects Apache ActiveMQ process (java.exe) spawning cmd.exe or PowerShell
  to download LockBit ransomware.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage: '*\activemq\*\java.exe'
    Image: '*\powershell.exe'
  condition: selection
level: medium
tags: []
references: []

MAL_RANSOM_LockBit_ActiveMQ_Dropper

yara · compile required before publication

rule MAL_RANSOM_LockBit_ActiveMQ_Dropper {
  strings:
    $s1 = "LockBit_3.0_Ransom" ascii wide nocase
    $s2 = "OpenWire_Deser_Exploit" ascii wide nocase
    $s3 = "activemq_cve_2023_46604" ascii wide nocase
  condition:
    any of them
}