alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Successful Apache ActiveMQ Remote Code Execution (CVE-2023-46604)"; flow:established,to_client; xbits:isset,ET.CVE-2023-46604.attempt, track ip_dst; http.response_body; content:"|3c|bean"; content:"|22|java|2e|lang|2e|ProcessBuilder|22|"; nocase; fast_pattern; distance:0; content:"init|2d|method|3d 22|start|22|"; within:100; content:"constructor|2d|arg"; distance:0; reference:url,attackerkb.com/topics/IHsgZDE3tS/cve-2023-46604; reference:url,activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; reference:url,github.com/X1r0z/ActiveMQ-RCE; reference:cve,2023-46604; classtype:successful-admin; sid:2049385; rev:1; metadata:attack_target Server, created_at 2023_11_29, cve CVE_2023_46604, deployment Perimeter, performance_impact Low, confidence High, signature_severity Critical, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_11_29, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)