---
analysis: While a rule can catch the exploit attempt, this hunt correlates the RCE
  with specific functional outcomes like named-pipe impersonation and rare injected
  processes across multiple surfaces (inventory, process, and network) to identify
  successful compromise.
blind_spots:
- id: missing-process-telemetry
  question: whether the Java process spawned a shell on hosts without telemetry
  requires: an endpoint agent on every server in scope
  risk: Exploitation could occur on unmonitored servers, leaving the intrusion invisible
    until lateral movement begins.
  stage: activemq-rce-exploitation
- id: lsass-handle-missing
  question: the specific access mask and call trace of LSASS access
  requires: Sysmon Event ID 10 or equivalent handle-auditing
  risk: Standard process activity does not show the 0x1010 VMRead access described
    in the article; without handle logs, we rely on the presence of the injected stager
    alone.
  stage: credential-dumping-lsass
coverage:
- stage: activemq-rce-exploitation
  status: covered
  steps:
  - identify-activemq-hosts
  - activemq-child-processes
- stage: metasploit-payload-ingress
  status: covered
  steps:
  - network-to-c2-ingress
  - activemq-child-processes
- stage: local-privilege-escalation
  status: covered
  steps:
  - meterpreter-escalation-signals
- stage: credential-dumping-lsass
  status: covered
  steps:
  - meterpreter-escalation-signals
- reason: Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit
    Ransomware' series.
  stage: internal-discovery-and-persistence
  status: out_of_scope
- reason: Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit
    Ransomware' series.
  stage: defense-evasion-and-log-clearing
  status: out_of_scope
- reason: Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit
    Ransomware' series.
  stage: lateral-movement-rdp
  status: out_of_scope
- reason: Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit
    Ransomware' series.
  stage: lockbit-ransomware-deployment
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: ActiveMQ RCE allows for rapid, high-privilege ingress; confirming
    the absence of these staging patterns provides a critical negative result for
    a known ransomware entry point.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An intruder has exploited CVE-2023-46604 on an ActiveMQ server to run
  arbitrary code, staged a Metasploit payload, and escalated to SYSTEM privileges
  using named pipe impersonation.
labels:
- hunt
- attack.t1190
- attack.t1105
- attack.t1059.003
- attack.t1134
- attack.t1055
- attack.t1003.001
name: ActiveMQ Exploitation and Metasploit Staging
parameters:
  c2_ips:
    default:
    - 166.62.100.52
    description: C2 server IPs observed in the report.
    from:
      kind: article
      observed: '2024-02-23'
      ref: https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/
    type: list[ip]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    type: number
  scope_hosts:
    default: []
    description: Optional list of hostnames to focus on.
    type: list[host]
  suspicious_utilities:
    default:
    - cmd.exe
    - powershell.exe
    - certutil.exe
    description: Binaries commonly spawned by the broker during RCE.
    from:
      kind: article
      observed: '2024-02-23'
      ref: https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/
    type: list[string]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Focus on servers hosting ActiveMQ and widen the search to any Java-based
  web application if the initial scope is empty.
references:
- name: "The DFIR Report \u2014 Apache ActiveMQ Exploit Leads to LockBit Ransomware"
  url: https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/
related:
- hunt: activemq-internal-reconnaissance
  reason: This hunt targets the beachhead; a following hunt tracks the actor's SMB
    scanning and lateral movement.
  relation: follows
scenario:
  stages:
  - name: Apache ActiveMQ RCE Exploitation
    observables:
    - CVE-2023-46604
    - org.springframework.context.support.ClassPathXmlApplicationContext
    - ActiveMQ server process java.exe parent
    - Java Spring bean configuration XML file download
    slug: activemq-rce-exploitation
    tactic: initial-access
    techniques:
    - T1190
  - name: Metasploit Payload Ingress
    observables:
    - certutil.exe -urlcache -f
    - uFSyLszKsuR.exe
    - C:\Users\\AppData\Local\Temp\uFSyLszKsuR.exe
    - 166.62.100.52
    slug: metasploit-payload-ingress
    tactic: execution
    techniques:
    - T1105
    - T1059.003
  - name: Privilege Escalation via getsystem
    observables:
    - cmd.exe /c echo kesknq > \\.\pipe\kesknq
    - Metasploit stager with SYSTEM level permissions
    - Service name kesknq
    slug: local-privilege-escalation
    tactic: privilege-escalation
    techniques:
    - T1134
    - T1055
  - name: Credential Access via LSASS Dumping
    observables:
    - lsass.exe memory access
    - GrantedAccess 0x1010 (VMRead)
    - CallTrace UNKNOWN indicative of injected code
    slug: credential-dumping-lsass
    tactic: credential-access
    techniques:
    - T1003.001
  - name: Internal Discovery and Persistence
    observables:
    - AnyDesk.exe installation
    - AnyDesk Service creation (Event ID 7045)
    - Advanced_IP_Scanner.exe
    - SMB traffic spikes (network scanning)
    slug: internal-discovery-and-persistence
    tactic: discovery
    techniques:
    - T1046
    - T1018
    - T1133
  - name: Defense Evasion and Log Clearing
    observables:
    - rdp.bat creation and deletion
    - wevtutil cl System
    - wevtutil cl Security
    - SystemSettingsAdminFlows.exe used to disable Windows Defender
    - Injected winlogon.exe creating batch files
    slug: defense-evasion-and-log-clearing
    tactic: defense-evasion
    techniques:
    - T1070.001
    - T1562.001
    - T1218
  - name: Lateral Movement via RDP and Services
    observables:
    - RDP connections using privileged service accounts
    - Remote service execution of Metasploit payloads
    - Firewall modification to allow port 3389
    slug: lateral-movement-rdp
    tactic: lateral-movement
    techniques:
    - T1021.001
    - T1021.002
    - T1543.003
  - name: LockBit Ransomware Deployment
    observables:
    - LockBit ransomware binary execution
    - Execution with specific path and password flags
    - Execution from Downloads folder via double-click
    slug: lockbit-ransomware-deployment
    tactic: impact
    techniques:
    - T1486
  summary: A threat actor exploited an internet-facing Apache ActiveMQ server using
    CVE-2023-46604 to execute code via Java Spring bean XML files, subsequently downloading
    a Metasploit stager using CertUtil. The intrusion involved privilege escalation
    via getsystem, credential dumping from LSASS, and extensive lateral movement using
    RDP and remote services before deploying LockBit ransomware.
series:
  index: 1
  slug: apache-activemq-exploit-leads-to-lockbit-ransomware
  title: Apache ActiveMQ Exploit Leads to LockBit Ransomware
  total: 3
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  network:
    category: network
    name: Network telemetry
    telemetry:
    - network
tlp: clear
type: investigation
---


# ActiveMQ Exploitation and Metasploit Staging

This hunt targets the initial breach and local consolidation phases of a ransomware intrusion. It begins by identifying the ActiveMQ footprint, then searches for anomalous process forks from the Java broker and outbound C2 connections. A follow-on phase hunts for Meterpreter-specific privilege escalation patterns, such as named-pipe impersonation and injected system processes. Two agent stages weigh the early and late evidence to confirm a beachhead and escalation before routing to containment.

## identify-activemq-hosts
<!-- Identify ActiveMQ infrastructure -->
Locate every host running Apache ActiveMQ to narrow the search for RCE signals.

```sqlite target=endpoint role=scoping
~~~yaml
expected: A list of hosts hosting the targeted application. Silence suggests no ActiveMQ
  is present in the inventory.
reads:
- device_hostname
- package_name
- package_version
- install_path
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-09-23'
~~~
SELECT DISTINCT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%activemq%' OR LOWER(install_path) LIKE '%activemq%')
```

## early-activity
<!-- Parallel search for RCE and C2 -->
parallel:
- → activemq-child-processes
- → network-to-c2-ingress
join: → triage-early-stage

## activemq-child-processes
<!-- Anomalous ActiveMQ child processes -->
Find the Java broker spawning shells or downloaders, which confirms RCE execution.

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts, suspicious_utilities=suspicious_utilities)
~~~yaml
expected: The ActiveMQ service spawning a utility like certutil.exe or a shell; this
  is high-fidelity evidence of exploitation.
reads:
- device_hostname
- process_name
- process_cmd_line
- parent_process_name
- time
silence: evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-09-23'
~~~
SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) LIKE '%java.exe' AND instr(',' || '{{suspicious_utilities}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## network-to-c2-ingress
<!-- Connections to Metasploit C2 -->
Correlate host activity with the reported IP of the Metasploit stager.

```sqlite target=network role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts, c2_ips=c2_ips)
~~~yaml
expected: Outbound traffic from the beachhead to the specified C2 IP.
reads:
- device_hostname
- process_name
- dst_endpoint_ip
- dst_endpoint_port
- time
silence: not_evidence_of_absence
source: hb_network_connection
verified: dry-run
verified_at: '2026-09-23'
~~~
SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## triage-early-stage
<!-- Triage initial staging -->
```agent target=hunter
cite: required
context:
- activemq-child-processes
- network-to-c2-ingress
max_iterations: 4
objective: Identify hosts where ActiveMQ executed a suspicious child and contacted
  the Metasploit C2 IP.
success_criteria: A verdict for each host in the early phase context.
tools:
- endpoint
- network
```

## meterpreter-escalation-signals
<!-- Named-pipe impersonation and rare system processes -->
Hunt for the follow-on escalation phase using Meterpreter-specific patterns and by baselining rare high-privilege processes.

```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Identification of the getsystem pipe echo pattern or an injected process
  running as SYSTEM on a single host.
prevalence:
  by: device_hostname
  key:
  - process_path
  rare_below: 3
reads:
- process_path
- process_cmd_line
- device_hostname
- integrity_level
- on_disk
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-09-23'
~~~
SELECT LOWER(process_path) AS path, process_cmd_line, device_hostname, integrity_level, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%echo % > \\.\\pipe\\%' OR on_disk = 0 OR LOWER(process_path) LIKE '%\\temp\\%') AND integrity_level = 'System' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4 HAVING hosts <= 3 ORDER BY hosts ASC
```

## triage-full-intrusion
<!-- Synthesize the intrusion chain -->
```agent target=hunter
cite: required
context:
- triage-early-stage
- meterpreter-escalation-signals
max_iterations: 6
objective: Confirm if a host transitioned from ActiveMQ RCE to high-integrity Metasploit
  execution.
success_criteria: A final verdict citing the specific commands and network connections
  across all phases.
tools:
- endpoint
- network
```

## route-on-verdict
<!-- Route on verdict -->
if~: "the triage-full-intrusion verdict is malicious for at least one host showing the transition to SYSTEM privileges" (confidence: high, judge=hunter)
then: → isolate-host
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: missing-process-telemetry)
else: → close-out

## isolate-host
<!-- Isolate compromised host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host immediately. Capture the process image of any injected or rare SYSTEM processes identified in the triage.
```
→ analyst-review

## analyst-review
<!-- Analyst forensic review -->
```manual target=analyst
Review the process command lines identified in the triage steps. Check for evidence of log clearing (System Log Event ID 104) and LSASS access (Sysmon Event ID 10).
```
→ close-out

## close-out
<!-- Close out -->
```manual target=analyst
Record the findings. Verify that the Apache ActiveMQ instance has been patched to version 5.18.3 or later.
```
→ end