Detect JetBrains TeamCity Unauthenticated Deserialization of Untrusted Data (CVE-2026-63077) in Microsoft Sentinel
Detects exploitation attempts against JetBrains TeamCity server targeting CWE-502 (Deserialization of Untrusted Data), CVE-2026-63077. This vulnerability is listed in CISA KEV and allows an unauthenticated or low-privileged attacker to submit crafted serialized objects to TeamCity server endpoints, resulting in remote code execution under the context of the TeamCity server process. Detection focuses on anomalous TeamCity server process spawning (java.exe/java spawning cmd/powershell/sh), suspicious agent-push/plugin upload artifacts, malformed or oversized serialized payloads in HTTP requests to TeamCity API/agent endpoints, and post-exploitation indicators such as new admin token creation, new build agent registration from unexpected hosts, or writes to the TeamCity plugins directory outside of normal deployment windows.
MITRE ATT&CK
KQL Detection Query
let TCHosts = dynamic([]);
DeviceProcessEvents
| where FileName in~ ("java.exe","java")
| where ProcessCommandLine has_any ("TeamCity", "buildAgent", "teamcity-agent")
| where InitiatingProcessFileName in~ ("java.exe","java")
| join kind=inner (
DeviceProcessEvents
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","sh","bash")
) on $left.ProcessId == $right.InitiatingProcessId
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName1=FileName, ProcessCommandLine1=ProcessCommandLine
| union (
DeviceFileEvents
| where FolderPath has_any ("\\plugins\\", "/plugins/", "\\.BuildServer\\", "/.BuildServer/")
| where ActionType in ("FileCreated","FileModified")
| where FileName endswith ".jar" or FileName endswith ".xml"
)
| sort by TimeGenerated descDetects TeamCity server (java) processes spawning command interpreters, and suspicious writes to TeamCity plugins/data directories, consistent with deserialization exploitation of CVE-2026-63077.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate TeamCity plugin installations or updates performed by administrators
- Scheduled build agent upgrades that touch the plugins directory
- Custom build steps that intentionally invoke shell scripts from Java build runners
Other platforms for CVE-2026-63077
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate TeamCity java process spawning a shell
Expected signal: Process creation event for java.exe followed by a child cmd.exe process with command line containing 'lab-simulation-cve-2026-63077'.
- Test 2Simulate suspicious plugin directory write
Expected signal: File creation event for evil-plugin.jar under a path containing '.BuildServer/plugins'.
- Test 3Simulate java process spawning shell on macOS/Linux
Expected signal: Process creation event showing /bin/sh spawned with parent process java, command line containing 'lab-simulation-cve-2026-63077'.
References (5)
- https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/
- https://www.jetbrains.com/privacy-security/issues-fixed/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-63077
Response Playbook
Triage
- Confirm TeamCity server version against JetBrains' fixed-version advisory for CVE-2026-63077 and validate whether the instance is internet-facing.
- Review TeamCity server logs (teamcity-server.log, catalina.out) and web access logs around the alert timestamp for anomalous requests to serialization-handling endpoints (agent registration, plugin upload, RPC endpoints).
- Inspect the process tree on the TeamCity host for java.exe/java spawning cmd.exe, powershell.exe, sh, or bash, and capture the full command line for further analysis.
- Check for newly created or modified files under the TeamCity plugins/ and .BuildServer/ data directories, and validate file hashes against known-good baselines.
Containment
- Isolate the affected TeamCity server host from the network while preserving forensic state, or place it behind a temporary firewall rule blocking inbound traffic to the TeamCity web/agent ports.
- Revoke and rotate all TeamCity access tokens, admin credentials, and any integrated VCS/CI credentials (e.g., GitHub/GitLab tokens) stored in TeamCity that may have been exposed.
Evidence Collection
- Collect a full memory image and disk image (or targeted forensic triage package) of the TeamCity server prior to remediation.
- Export TeamCity server logs, access logs, and OS-level process/EDR telemetry covering at least 30 days prior to the alert for timeline reconstruction.
Escalation Criteria
- !Escalate immediately if evidence shows successful remote code execution (e.g., a shell spawned by the TeamCity java process) or unauthorized outbound network connections from the server.
- !Escalate if new administrative accounts, build agents, or plugins were created/registered that were not authorized by change management, indicating potential persistence or supply-chain compromise via CI/CD pipeline poisoning.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
TeamCity server logs (teamcity-server.log) showing malformed or unusual RPC/agent registration requests - >
Unexpected .jar or .xml files written to the TeamCity plugins/ or .BuildServer/ directories with timestamps outside change windows - >
Process creation events showing java.exe/java as parent of cmd.exe, powershell.exe, sh, or bash
Tuning Guidance
Baseline normal TeamCity administrative and build-runner behavior (e.g., known plugin update windows, expected build steps that shell out) before enabling this rule in blocking/alerting mode. Scope the java-parent-spawns-shell logic to hosts explicitly running TeamCity server/agent roles to reduce noise from unrelated Java applications, and suppress known CI build steps that legitimately invoke shell commands from Java-based runners.
Hunting Queries
Broad hunt across the environment for any java parent process spawning a shell, to identify TeamCity hosts (or other Java apps) potentially exploited via deserialization.
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("java.exe","java")
| where FileName in~ ("cmd.exe","powershell.exe","sh","bash")
| summarize count() by DeviceName, ProcessCommandLine, bin(TimeGenerated, 1h)index=edr Image="*java*" (Image="*cmd.exe*" OR Image="*powershell*" OR Image="*/sh" OR Image="*/bash") | stats count by host, CommandLine, _timeAtomic Red Team Tests
Simulates the post-exploitation behavioral pattern of a TeamCity server (java) process spawning a command interpreter, without exploiting the actual deserialization flaw.
Command
Start-Process -FilePath "$env:JAVA_HOME\bin\java.exe" -ArgumentList "-cp . TestTeamCityStub" ; Start-Sleep -Seconds 2 ; cmd.exe /c "echo lab-simulation-cve-2026-63077"Cleanup
Stop-Process -Name java -Force -ErrorAction SilentlyContinueExpected Telemetry
Process creation event for java.exe followed by a child cmd.exe process with command line containing 'lab-simulation-cve-2026-63077'.
Expected Detection
KQL/SPL rule fires on java.exe (or parent process matching java) spawning cmd.exe.
Simulates an attacker dropping a malicious plugin jar into the TeamCity plugins directory following exploitation, in a lab environment.
Command
mkdir -p /tmp/teamcity_lab/.BuildServer/plugins && touch /tmp/teamcity_lab/.BuildServer/plugins/evil-plugin.jarCleanup
rm -rf /tmp/teamcity_labExpected Telemetry
File creation event for evil-plugin.jar under a path containing '.BuildServer/plugins'.
Expected Detection
File integrity/EDR rule flags .jar creation in TeamCity plugins directory outside change windows.
Simulates a Java process (representing TeamCity server) spawning a shell interpreter, mirroring exploitation behavior for CVE-2026-63077.
Command
java -version >/dev/null 2>&1; (sleep 1; /bin/sh -c 'echo lab-simulation-cve-2026-63077') &Cleanup
pkill -f 'lab-simulation-cve-2026-63077' || trueExpected Telemetry
Process creation event showing /bin/sh spawned with parent process java, command line containing 'lab-simulation-cve-2026-63077'.
Expected Detection
EQL/EDR rule fires on java parent process spawning /bin/sh within the 5-minute sequence window.