← Back to SOC feed Coverage →

tomcat-8-executing-powershell

kql MEDIUM Azure-Sentinel
DeviceProcessEvents
exploithuntingmicrosoftofficialpowershell
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-06T11:00:00Z · Confidence: medium

Hunt Hypothesis

The hypothesis is that the detection identifies a Sysrv botnet command and control activity where PowerShell is executed to exfiltrate data or execute malicious payloads on compromised Windows servers. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate Sysrv botnet infections early, preventing resource theft and cryptocurrency mining activities.

KQL Query

DeviceProcessEvents
| where InitiatingProcessParentFileName startswith 'tomcat'
| where InitiatingProcessFileName in~("cmd.exe", "powershell.exe") and InitiatingProcessCommandLine hasprefix '-enc '
and ProcessCommandLine has_any ('cmd.exe','powershell.exe','sc.exe','schtasks.exe','WMIC.exe')

Analytic Rule Definition

id: eb5c922d-37f2-4790-9fa2-efd113c0f6d9
name: tomcat-8-executing-powershell
description: |
  This query was originally published in the threat analytics report, Sysrv botnet evolution.
  Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
  The following query finds instances of Apache Tomcat 8 being exploited to execute encoded PowerShell commands.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents
  | where InitiatingProcessParentFileName startswith 'tomcat'
  | where InitiatingProcessFileName in~("cmd.exe", "powershell.exe") and InitiatingProcessCommandLine hasprefix '-enc '
  and ProcessCommandLine has_any ('cmd.exe','powershell.exe','sc.exe','schtasks.exe','WMIC.exe')

Required Data Sources

Sentinel TableNotes
DeviceProcessEventsEnsure this data connector is enabled

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Campaigns/Sysrv-botnet/tomcat-8-executing-powershell.yaml