TGI HUNT Frequently Abused Java Invocation in HTTP POST Body

SID: 2610460Rev: 112 views
History
Sourcetgreen/hunting
CreatedMarch 19, 2025
UpdatedMarch 19, 2025
Classificationbad-unknown
alert http any any -> any any (msg:"TGI HUNT Frequently Abused Java Invocation in HTTP POST Body"; flow:established,to_server; content:"java.lang.ProcessBuilder"; threshold:type limit, track by_src, seconds 60, count 1; classtype:bad-unknown; reference:url,blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html; sid:2610460; rev:1;)

References

urlblog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!