CVE-2020-9548

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName has "java" and FileName in ("powershell.exe", "cmd.exe", "sh", "bash")
| where ProcessCommandLine has "br.com.anteros.dbcp.AnterosDBCPConfig" or InitiatingProcessCommandLine has "jackson-databind"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath

Splunk SPL

index=* (sourcetype=sysmon OR sourcetype=process_events) (parent_process_name="java" OR process_name="java") (process="powershell.exe" OR process="cmd.exe" OR process="sh" OR process="bash") (command_line="*br.com.anteros.dbcp.AnterosDBCPConfig*" OR command_line="*jackson-databind*")

Sigma

title: Jackson-databind AnterosDBCPConfig RCE
status: experimental
description: Detects potential remote code execution via FasterXML jackson-databind exploiting br.com.anteros.dbcp.AnterosDBCPConfig gadget.
references:
  - https://github.com/FasterXML/jackson-databind/issues/2634
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\java.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\sh'
      - '\bash'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
tags:
  - attack.execution
  - cve.2020.9548
  - car.2013-08-001

Elastic ES|QL

from process where event.type == "start" and process.parent.executable == "java" and process.executable in ("powershell.exe", "cmd.exe", "sh", "bash") and (process.command_line : "*br.com.anteros.dbcp.AnterosDBCPConfig*" or process.parent.command_line : "*jackson-databind*")