# CVE-2023-46604 — Apache ActiveMQ RCE Indicators of Compromise
# Generated by Lyrie Threat Intelligence (lyrie.ai/research)
# Date: 2026-04-25

## Network Indicators

# ActiveMQ OpenWire ports
tcp/61616 (default OpenWire)
tcp/61617 (alternate OpenWire)

# Protocol signatures
ExceptionResponse
ClassPathXmlApplicationContext
org.springframework.context.support.ClassPathXmlApplicationContext

## Traffic Patterns

# Suspicious connections to OpenWire from external IPs
# Large payloads to port 61616/61617 (>1KB)
# HTTP traffic immediately after OpenWire connection (XML fetch)

## File System Indicators

# Suspicious XML files fetched by ActiveMQ
/tmp/*.xml
/var/tmp/*.xml
/tmp/poc.xml

# ActiveMQ logs showing ClassPathXmlApplicationContext
/var/log/activemq/activemq.log
/opt/activemq/data/activemq.log

## Process Indicators

# Suspicious child processes of ActiveMQ
calc.exe (Windows PoC)
calc (Linux PoC)
/bin/sh -c <command>
/bin/bash -c <command>
cmd.exe /c <command>
powershell.exe -c <command>

# Network tools spawned by ActiveMQ
nc / netcat
wget
curl
python
perl

## Behavioral Indicators

# ActiveMQ process making outbound HTTP connections (fetching XML)
# ActiveMQ spawning unexpected child processes
# Network connections from ActiveMQ to unusual ports (reverse shells)

## Detection Queries

# Zeek/Suricata (network)
tcp port 61616 or tcp port 61617
content:"ClassPathXmlApplicationContext"

# Splunk
index=network dest_port IN (61616,61617) 
| search payload="*ClassPathXmlApplicationContext*"

# Elastic/OpenSearch
network.transport: tcp AND destination.port: (61616 OR 61617) AND network.payload: *ClassPathXmlApplicationContext*

# Process monitoring (Sysmon/auditd)
parent_process_name: java
parent_command_line: *activemq*
process_name: (calc|calc.exe|sh|bash|cmd.exe|nc|wget|curl)

## XML Payload Signatures

# Spring bean RCE patterns
<beans xmlns="http://www.springframework.org/schema/beans"
<bean class="java.lang.ProcessBuilder">
<constructor-arg>
<value>calc.exe</value>
<value>/bin/sh</value>
<value>cmd.exe</value>

## Mitigation Verification

# Check ActiveMQ version (patched = 5.18.3+, 5.17.6+, 5.16.7+)
# Verify OpenWire disabled or restricted to trusted IPs
# Check for ClassPathXmlApplicationContext in ActiveMQ logs (should be empty post-patch)
