CVE-2026-35273: ShinyHunters Bypass WAFs to Exploit Oracle PeopleSoft — Detection and Remediation Guide

---
title: PeopleSoft Web Server Process Spawning Shell or Script Interpreter
id: 3f8a2b71-9c4d-4e5f-a1b2-7c6d5e4f3a2b
status: experimental
description: Detects cmd.exe, PowerShell, or script interpreters spawned by Java or web server processes associated with the PeopleSoft PIA web tier, consistent with web shell execution following CVE-2026-35273 exploitation.
references:
  - https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/24
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
      - '\wls.exe'
      - '\httpd.exe'
      - '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare administrative scripts invoked from application management consoles; validate against change records
level: high
---
title: Web Server Process Spawning Shell on Linux PeopleSoft Tier
id: 8c1d4e52-6a7b-4f38-9d01-2e3f4a5b6c7d
status: experimental
description: Detects shell or interpreter execution parented by Java/WebLogic or web server processes on Linux PeopleSoft web tiers, indicative of web shell activity post-exploitation of CVE-2026-35273.
references:
  - https://thehackernews.com/2026/09/attackers-bypass-wafs-to-exploit-oracle.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/24
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Health-check or startup scripts legitimately invoked by the application stack; baseline and exclude known paths
level: high

// Hunt: shell/interpreter child processes of PeopleSoft web tier (Java/WebLogic)
// across Windows and Linux endpoints in Defender / Sentinel
let WebParents = dynamic(["java.exe", "javaw.exe", "wls.exe", "httpd.exe", "w3wp.exe", "java", "httpd", "nginx"]);
let ShellChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "certutil.exe", "sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat"]);
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| extend ParentName = tolower(split(InitiatingProcessFileName, "")[0]),
         ChildName = tolower(FileName)
| where ParentName in~ (WebParents)
| where ChildName in~ (ShellChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, SHA256
| order by TimeGenerated desc;

// Hunt: web access log indicators for PeopleSoft PIA probing and anomalous encoded requests
// Requires web proxy/WAF/IIS logs ingested into CommonSecurityLog or a custom table
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where RequestURL has_any ("/psc/", "/psp/")
| extend Encoded = iff(RequestURL matches regex @"(%25|%u[0-9a-fA-F]{4}|%c0|%e0)", 1, 0)
| summarize Requests = count(), EncodedRequests = sum(Encoded),
            DistinctSources = dcount(SourceIP),
            Sources = make_set(SourceIP, 10)
  by RequestURL, DeviceAction
| where EncodedRequests > 0 or DistinctSources > 50
| order by EncodedRequests desc;

-- Hunt for web shells dropped into PeopleSoft PIA web-accessible directories
-- Adjust glob roots to your actual PeopleSoft PIA deployment paths (Windows and Linux)
LET shell_paths = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/psoft/*/webserv/*/applications/peoplesoft/PORTAL.war/**/*.jsp',
  'C:/psoft/*/webserv/*/applications/**/*.jspx',
  '/home/psoft/*/webserv/*/applications/peoplesoft/PORTAL.war/**/*.jsp',
  '/opt/psoft/*/webserv/*/applications/**/*.jsp'
])
WHERE NOT IsDir

SELECT FullPath, Size, Mtime, Ctime
FROM shell_paths
-- Web shells are typically very recent, very small, or both --
WHERE Mtime > Now() - 60 * 24 * 3600
   OR Size < 5000
ORDER BY Mtime DESC

-- Hunt for web-tier processes with unexpected child shells or outbound connections
SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)java|httpd|w3wp'
   OR (CommandLine =~ '(?i)cmd\.exe|powershell|/bin/(ba)?sh' 
       AND Ppid != 0)

# PeopleSoft CVE-2026-35273 verification and triage script (Windows web tier)
# Run elevated on each PeopleSoft PIA web server.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1) Inventory PeopleSoft PIA web content directories for recent or small JSP files
$piaRoots = @('C:\psoft','D:\psoft','C:\oracle','D:\oracle')
foreach ($root in $piaRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.jsp,*.jspx -File |
            Where-Object { $_.FullName -match 'PORTAL\.war|applications' } |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-60) -or $_.Length -lt 5000 } |
            ForEach-Object {
                $hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
                $report += [pscustomobject]@{
                    Type='SuspiciousWebFile'; Path=$_.FullName; Size=$_.Length
                    Modified=$_.LastWriteTime; SHA256=$hash
                }
            }
    }
}

# 2) Check for shell-spawning children of Java/web processes (live state)
Get-CimInstance Win32_Process |
    Where-Object { $_.Name -match 'cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|rundll32\.exe' } |
    ForEach-Object {
        $parent = Get-CimInstance Win32_Process -Filter "ProcessId=$($_.ParentProcessId)"
        if ($parent -and $parent.Name -match 'java|w3wp|httpd') {
            $report += [pscustomobject]@{
                Type='WebProcessShellSpawn'; Path=$parent.Name
                Size=$null; Modified=$_.CreationDate
                SHA256="Child: $($_.Name) :: $($_.CommandLine)"
            }
        }
    }

# 3) Confirm installed Oracle CPU / PeopleTools patch level for verification against the advisory
$report += Get-ItemProperty 'HKLM:\SOFTWARE\Oracle\*' |
    Select-Object @{n='Type';e={'OracleRegistryKey'}},
                  @{n='Path';e={$_.PSChildName}},
                  @{n='Size';e={$null}},
                  @{n='Modified';e={$null}},
                  @{n='SHA256';e={($_.PSObject.Properties | Out-String).Trim()}}

$report | Format-List
$report | Export-Csv -Path ".\peoplesoft_cve-2026-35273_triage_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
Write-Host "Triage complete. Review the CSV for unexpected JSPs or web-process shell spawns, then compare patch state against the Oracle Critical Patch Update advisory for CVE-2026-35273."

# PeopleSoft CVE-2026-35273 triage for Linux PIA web tiers
# 1) Find recent or unusually small JSPs in web-accessible deployment dirs
find /home/psoft /opt/psoft -type d \( -name "PORTAL.war" -o -name "applications" \) 2>/dev/null | while read -r d; do
  find "$d" -type f \( -name "*.jsp" -o -name "*.jspx" \) \( -mtime -60 -o -size -5k \) -printf "%T@ %s %p\n" 2>/dev/null
done | sort -rn | head -100

# 2) Hash any candidates for VT/EDR lookups
find /home/psoft /opt/psoft -type f \( -name "*.jsp" -o -name "*.jspx" \) -mtime -60 -exec sha256sum {} \; 2>/dev/null

# 3) Check for web-tier processes with shell children
for pid in $(pgrep -f 'java|httpd'); do
  ps --ppid "$pid" -o pid,ppid,comm,args 2>/dev/null | grep -E 'sh|bash|python|perl|curl|wget' && echo "-- parent: $pid"
done

# 4) Review access logs for encoded/probing requests against PIA paths
grep -Eh '%25|%u[0-9a-fA-F]{4}|%c0|%e0' /path/to/access_log* 2>/dev/null | grep -E '/psc/|/psp/' | awk '{print $1}' | sort | uniq -c | sort -rn | head -25