Free Sigma Rule Generator

title: Potential CVE-2023-39261 Exploitation - IntelliJ IDEA Suspicious Child Process
id: b0de3650-31da-4d99-8a40-8943a3c2dcd8
status: experimental
description: |
  Detects potential exploitation of CVE-2023-39261 in JetBrains IntelliJ IDEA
  (and IntelliJ-family IDEs) prior to the 2023.2.x fix wave. The vulnerability
  allows a malicious project or plugin to execute arbitrary code via the IDE's
  scripting/plugin engine. This rule flags suspicious child processes spawned
  by the IDE binary — particularly shells, downloaders, and LOLBins — that are
  not part of normal IDE build/run workflows.
  CVSS: 7.8 (High) | KEV Status: Not listed on CISA KEV as of rule creation.
  Starting point — tune for your environment.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2023-39261
  - https://www.jetbrains.com/privacy-security/issues-fixed/
  - https://blog.jetbrains.com/idea/2023/08/intellij-idea-2023-2-1/
author: SARA Detection Engineering
date: 2026-09-11
tags:
  - attack.execution
  - attack.t1059
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1059.004
  - attack.t1218
  - attack.t1218.011
  - attack.initial_access
  - attack.t1195
  - attack.t1195.002
logsource:
  product: windows
  category: process_creation
detection:
  selection_ide_parent:
    ParentImage|endswith:
      - '\idea.exe'
      - '\idea64.exe'
      - '\pycharm.exe'
      - '\pycharm64.exe'
      - '\webstorm.exe'
      - '\webstorm64.exe'
      - '\rider.exe'
      - '\rider64.exe'
      - '\phpstorm.exe'
      - '\phpstorm64.exe'
      - '\goland.exe'
      - '\goland64.exe'
      - '\clion.exe'
      - '\clion64.exe'
      - '\studio64.exe'
  selection_susp_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
      - '\java.exe'
      - '\javaw.exe'
  selection_susp_cli_flags:
    CommandLine|contains:
      - ' -enc '
      - ' -encodedcommand '
      - ' -e '
      - 'Invoke-Expression'
      - 'IEX '
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'Invoke-RestMethod'
      - 'irm '
      - 'DownloadString'
      - 'DownloadFile'
      - ' -w hidden'
      - ' -windowstyle hidden'
      - ' -nop '
      - ' -noexit '
      - '/c powershell'
      - '/c curl'
      - '/c wget'
      - '/c certutil'
      - '/c bitsadmin'
      - 'http://'
      - 'https://'
      - 'ftp://'
      - 'base64'
      - ' -decode '
      - ' -urlcache'
      - ' -split'
      - 'mshta http'
      - 'regsvr32 /s /u /i:http'
      - 'rundll32 javascript'
  filter_legitimate_build:
    ParentCommandLine|contains:
      - '\bin\'
      - 'gradle'
      - 'maven'
      - 'ant '
    Image|endswith:
      - '\java.exe'
      - '\javaw.exe'
  filter_legitimate_run_config:
    CommandLine|contains:
      - 'org.jetbrains.'
      - 'com.intellij.'
      - 'junit'
      - 'testng'
      - '-Didea.'
  condition: selection_ide_parent and selection_susp_child and selection_susp_cli_flags and not 1 of filter_*
fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - User
  - IntegrityLevel
falsepositives:
  - Legitimate IDE run configurations that invoke external tools via cmd or PowerShell with download-like arguments.
  - Build scripts (Gradle/Maven) that shell out to package managers.
  - Developer-initiated terminal sessions spawned from the IDE's built-in terminal.
level: high