CVE-2026-34197: Unauthenticated Code Execution in Hitachi Energy SOI (Apache ActiveMQ) — Detection and Remediation Guide

---
title: Apache ActiveMQ Broker JVM Spawning Shell - Windows
id: 4e8b1c2a-7f3d-4a91-b6e5-9c2d8f4a1b07
status: experimental
description: Detects the Java process hosting Apache ActiveMQ spawning command shells or script interpreters, a strong post-exploitation indicator for unauthenticated code execution flaws such as CVE-2026-34197 in Hitachi Energy SOI.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-04
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
    ParentCommandLine|contains:
      - 'activemq'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Custom broker administrative scripts legitimately invoked via the JVM (rare; baseline and exclude by full command line)
level: critical
---
title: Apache ActiveMQ Broker JVM Spawning Shell - Linux
id: 8c2f6d19-3b47-4e58-a1c2-6d9e5b7f3a04
status: experimental
description: Detects the ActiveMQ Java broker process spawning shells, interpreters, or download utilities on Linux SOI hosts, consistent with exploitation of unauthenticated code execution vulnerabilities such as CVE-2026-34197.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-04
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/java'
    ParentCommandLine|contains: 'activemq'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor maintenance scripts executed by the broker service account (baseline and exclude by full command line)
level: critical
---
title: Network Connection to ActiveMQ Listener Ports from Unexpected Host
id: 2b7e4f81-9d36-4c12-a8e9-5f1c3a6b8d02
status: experimental
description: Identifies inbound network connections to Apache ActiveMQ listener ports (OpenWire 61616, web console/Jolokia 8161, AMQP 5672, STOMP 61613, MQTT 1883) on SOI hosts. After baselining authorized broker clients and management systems, residual hits indicate potential reconnaissance or exploitation attempts against CVE-2026-34197.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-04
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 61616
      - 8161
      - 5672
      - 61613
      - 1883
    Initiated: 'false'
  condition: selection
falsepositives:
  - Legitimate JMS clients, SOI application components, and broker administration from authorized management hosts (baseline known-good source IPs and exclude)
level: medium

// Hunt 1: Post-exploitation - ActiveMQ broker JVM spawning shells/interpreters (CVE-2026-34197)
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("java.exe", "java", "javaw.exe")
| where InitiatingProcessCommandLine has "activemq"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "rundll32.exe", "certutil.exe", "curl.exe", "wget.exe", "sh", "bash", "python", "python3", "perl", "nc", "ncat")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| order by Timestamp desc;

// Hunt 2: New/uncommon external sources talking to ActiveMQ listener ports on SOI hosts
// Requires your SOI host list - populate the dynamic array accordingly
let SoiHosts = dynamic(["SOI-SERVER-01", "SOI-SERVER-02"]);
let Lookback = 30d;
let Recent = 1d;
let KnownClients = DeviceNetworkEvents
| where Timestamp > ago(Lookback) and Timestamp < ago(Recent)
| where DeviceName in~ (SoiHosts)
| where LocalPort in (61616, 8161, 5672, 61613, 1883)
| summarize by RemoteIP;
DeviceNetworkEvents
| where Timestamp > ago(Recent)
| where DeviceName in~ (SoiHosts)
| where LocalPort in (61616, 8161, 5672, 61613, 1883)
| where RemoteIP !in (KnownClients)
| where not(ipv4_is_private(RemoteIP)) // flag external reachability first; remove line to include internal outliers
| summarize FirstSeen = min(Timestamp), Connections = count(), Ports = make_set(LocalPort), Actions = make_set(ActionType) by DeviceName, RemoteIP
| order by FirstSeen desc;

// Hunt 3: Syslog/CEF-ingested firewall or sensor data showing inbound attempts to ActiveMQ ports (for network devices forwarding to Sentinel)
CommonSecurityLog
| where DestinationPort in (61616, 8161, 5672, 61613, 1883)
| where DeviceAction !in ("Allow", "allow") == false or DeviceAction in ("Allow", "allow")
| summarize Attempts = count(), UniqueSources = dcount(SourceIP), Actions = make_set(DeviceAction) by DestinationIP, DestinationPort, bin(TimeGenerated, 1h)
| where Attempts > 20 or UniqueSources > 10
| order by Attempts desc;

-- Hunt: Identify ActiveMQ broker processes, their listening ports, and any child processes
-- Relevant to CVE-2026-34197 post-exploitation triage on Hitachi Energy SOI hosts

LET brokers = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'activemq'

SELECT brokers.Pid AS BrokerPid,
       brokers.Username AS BrokerUser,
       brokers.CommandLine AS BrokerCmdline,
       child.Name AS ChildName,
       child.CommandLine AS ChildCmdline,
       child.CreateTime AS ChildStartTime
FROM pslist() AS child
JOIN brokers ON child.Ppid = brokers.Pid

// Also enumerate listening sockets for ActiveMQ transport connectors
SELECT Pid, Name, Address, Port, Status
FROM netstat()
WHERE Port IN (61616, 8161, 5672, 61613, 1883)
  AND Status =~ 'LISTEN'

#!/bin/bash
# CVE-2026-34197 interim hardening - restrict Apache ActiveMQ listener exposure on Hitachi Energy SOI hosts
# Test in a staging environment before production OT deployment. Coordinate with operations before blocking ports.
set -euo pipefail

ALLOWED_SUBNET="10.10.50.0/24"   # Authorized JMS clients / management subnet - CHANGE THIS
ACTIVEMQ_PORTS="61616 8161 5672 61613 1883"

echo "=== [1] Identify running ActiveMQ broker processes ==="
ps -eo pid,user,args | grep -i '[a]ctivemq' || echo "No ActiveMQ process found - verify SOI installation state."

echo ""
echo "=== [2] Identify ActiveMQ version from installation jars ==="
BROKER_PID=$(pgrep -f 'activemq' | head -n1 || true)
if [ -n "${BROKER_PID}" ]; then
  BROKER_CWD=$(readlink -f "/proc/${BROKER_PID}/cwd" || echo "unknown")
  echo "Broker PID: ${BROKER_PID} | CWD: ${BROKER_CWD}"
  find / -name 'activemq-broker-*.jar' 2>/dev/null | head -n 5
else
  echo "Broker not running; search filesystem for ActiveMQ jars to confirm component presence."
fi

echo ""
echo "=== [3] Current listening sockets on ActiveMQ ports ==="
ss -tlnp 2>/dev/null | grep -E ':(61616|8161|5672|61613|1883)\b' || echo "No ActiveMQ listeners detected."

echo ""
echo "=== [4] Apply host firewall restrictions (allow only ${ALLOWED_SUBNET}) ==="
for PORT in ${ACTIVEMQ_PORTS}; do
  iptables -C INPUT -p tcp --dport "${PORT}" -s "${ALLOWED_SUBNET}" -j ACCEPT 2>/dev/null \
    || iptables -I INPUT -p tcp --dport "${PORT}" -s "${ALLOWED_SUBNET}" -j ACCEPT
  iptables -C INPUT -p tcp --dport "${PORT}" -j DROP 2>/dev/null \
    || iptables -A INPUT -p tcp --dport "${PORT}" -j DROP
  echo "Restricted tcp/${PORT} to ${ALLOWED_SUBNET}"
done

echo ""
echo "=== [5] Verify rules ==="
iptables -L INPUT -n --line-numbers | grep -E '61616|8161|5672|61613|1883' || echo "Verification failed - review iptables state manually."

echo ""
echo "=== NEXT STEPS ==="
echo "1. Persist firewall rules per your distro (iptables-save / netfilter-persistent / firewalld)."
echo "2. Apply the Hitachi Energy fixed release per CSAF advisory ICSA-26-279-04 - firewall rules are compensating controls only."
echo "3. Review ActiveMQ logs (data/activemq.log, data/audit.log if enabled) for suspicious connections predating this restriction."