Detect Apache ActiveMQ Improper Input Validation (CVE-2026-34197) in Microsoft Sentinel
Detects exploitation of CVE-2026-34197, an improper input validation vulnerability (CWE-20/CWE-94) in Apache ActiveMQ that has been added to the CISA Known Exploited Vulnerabilities catalog. Successful exploitation may allow remote attackers to execute arbitrary code or inject malicious content via crafted messages or broker connections. ActiveMQ's OpenWire protocol and web console are common attack surfaces for this class of vulnerability.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
KQL Detection Query
let activemq_ports = dynamic([61616, 61617, 8161, 8162, 5672, 1883, 61613]);
let suspiciousPatterns = dynamic(["classInfo", "ExceptionResponse", "../", "%2e%2e", "cmd.exe", "/bin/sh", "powershell", "wget", "curl", "ClassPathXmlApplicationContext"]);
union
(
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort in (activemq_ports) or SourcePort in (activemq_ports)
| where Message has_any (suspiciousPatterns) or RequestURL has_any (suspiciousPatterns)
| extend AttackVector = "network_request"
),
(
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort in (activemq_ports) or LocalPort in (activemq_ports)
| where InitiatingProcessCommandLine has_any (suspiciousPatterns)
| extend AttackVector = "process_network"
),
(
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where ParentProcessName in~ ("activemq.bat", "activemq", "java") or ProcessCommandLine has "activemq"
| where ProcessCommandLine has_any (["cmd.exe", "powershell", "bash", "sh", "wget", "curl", "nc", "ncat", "/tmp/", "base64"])
| extend AttackVector = "process_spawn"
)
| project TimeGenerated, AttackVector, DeviceName, AccountName, ProcessCommandLine, RemoteIP, RemotePort, AdditionalFields
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Vectors=make_set(AttackVector) by DeviceName, RemoteIP
| where Count >= 1Detects Apache ActiveMQ exploitation attempts via CVE-2026-34197 by correlating suspicious network connections to ActiveMQ ports with process spawning anomalies and known malicious payload patterns in network traffic and process command lines.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate ActiveMQ administrative tasks via CLI tools such as activemq-admin or management scripts
- Authorized penetration testing or red team exercises targeting ActiveMQ brokers
- Java process restarts or health-check scripts spawned by monitoring agents
- Scheduled data pipeline scripts that use curl or wget to interact with ActiveMQ REST API
Other platforms for CVE-2026-34197
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1ActiveMQ OpenWire Port Probe with Malicious Payload Pattern
Expected signal: Network connection event to port 61616 from non-standard source; payload content containing 'ClassPathXmlApplicationContext' visible in network capture or IDS alerts
- Test 2Simulated Post-Exploitation Shell Spawn from Java Process
Expected signal: Sysmon Event ID 1 or Linux audit execve showing bash/sh spawned with parent process containing 'java' in the image path; process command line containing 'id', 'hostname', or 'whoami'
- Test 3ActiveMQ Web Console Access with Path Traversal Attempt
Expected signal: HTTP access log entries on port 8161 containing '../' path sequences and 'ClassPathXmlApplicationContext' in request body or destination parameter; network connection events to port 8161 from unexpected source
Unlock Pro Content
Get the full detection package for CVE-2026-34197 including response playbook, investigation guide, and atomic red team tests.