CVE-2026-63077: JetBrains TeamCity Unauthenticated RCE Under Active Exploitation — Detection and Remediation Guide

---
title: TeamCity Server Process Spawning Shell or Script Interpreter
id: 8f2c4a91-3d7e-4b6a-9c15-2e8f0a1d4b6c
status: experimental
description: Detects the TeamCity server Java process spawning command shells or script interpreters, a strong indicator of post-exploitation activity following RCE such as CVE-2026-63077. TeamCity server (not build agents) should rarely spawn interactive shells.
references:
  - https://www.securityweek.com/hackers-start-exploiting-recent-jetbrains-teamcity-vulnerability/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
    ParentCommandLine|contains:
      - 'teamcity'
      - 'catalina'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Build steps executing on the server agent co-located with the TeamCity server — exclude known build agent service paths
level: high
---
title: Webshell or Script Dropped in TeamCity Web Directory
id: 3b7e1d52-9a4f-4c82-b6d1-5e0f2a8c9d3e
status: experimental
description: Detects creation of executable script or JSP files within TeamCity web application directories, consistent with webshell deployment after exploitation of CVE-2026-63077.
references:
  - https://www.securityweek.com/hackers-start-exploiting-recent-jetbrains-teamcity-vulnerability/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\TeamCity\webapps\'
      - '\TeamCity\work\'
      - '\TeamCity\temp\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.asp'
      - '.aspx'
      - '.php'
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
  condition: selection_path and selection_ext
falsepositives:
  - TeamCity upgrades and plugin installations — correlate with maintenance windows
level: high
---
title: Suspicious Process Access to TeamCity Data Directory Secrets
id: 6c1f9e74-2b8a-4d35-a7c9-8f3e1b6d0a42
status: experimental
description: Detects non-TeamCity processes reading files from the TeamCity data directory where configuration, project settings, and stored credentials reside — a hallmark of post-exploitation secret harvesting.
references:
  - https://www.securityweek.com/hackers-start-exploiting-recent-jetbrains-teamcity-vulnerability/
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\.BuildServer\config\'
      - '\.BuildServer\system\'
  filter_legit:
    Image|endswith:
      - '\java.exe'
      - '\javaw.exe'
      - '\TeamCityService.exe'
      - '\MsMpEng.exe'
      - '\MsSense.exe'
  condition: selection and not filter_legit
falsepositives:
  - Backup and EDR agents — tune exclusions to your environment's approved tooling
level: medium

let lookback = 14d;
let teamcity_parents = dynamic(["java.exe", "javaw.exe", "java", "TeamCityService.exe"]);
let suspicious_children = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe", "nc.exe", "sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat"]);
union isfuzzy=true
    (DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where InitiatingProcessFileName in~ (teamcity_parents)
       or InitiatingProcessCommandLine has_any ("teamcity", "catalina")
    | where FileName in~ (suspicious_children)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, ReportId),
    (Syslog
    | where TimeGenerated > ago(lookback)
    | where Facility == "user" or Facility == "daemon"
    | where SyslogMessage has_any ("teamcity", "catalina")
    | where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl", "wget", "python", "nc ")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage)
| order by TimeGenerated desc

let lookback = 14d;
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe", "java")
   and InitiatingProcessCommandLine has_any ("teamcity", "catalina")
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            Destinations = make_set(RemoteUrl, 20), Ports = make_set(RemotePort, 10)
  by DeviceName, RemoteIP
| where ConnectionCount < 50  // low-volume, novel egress is more suspicious than steady CI traffic
| order by FirstSeen asc

-- Hunt for suspicious TeamCity server child processes and network connections
-- Relevant to CVE-2026-63077 post-exploitation triage
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(cmd\.exe|powershell|pwsh|mshta|certutil|bitsadmin|/bin/sh|/bin/bash|curl |wget |nc -|python)'
  AND Ppid IN (
      SELECT Pid FROM pslist()
      WHERE Name =~ '(?i)java|TeamCityService'
        AND CommandLine =~ '(?i)teamcity|catalina'
  )

-- Enumerate network connections owned by the TeamCity server process
SELECT Pid,
       Name,
       Status,
       Laddr,
       Raddr,
       Family
FROM netstat()
WHERE Pid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ '(?i)java|TeamCityService'
      AND CommandLine =~ '(?i)teamcity|catalina'
)
  AND Status =~ 'ESTAB|LISTEN'

#!/bin/bash
# CVE-2026-63077 triage — identify TeamCity installs, version, and exposure

echo "=== TeamCity process check ==="
ps aux | grep -i [t]eamcity

echo ""
echo "=== TeamCity version (from build.txt / server logs) ==="
find /opt /home /usr/local -maxdepth 4 -iname "build.txt" -path "*TeamCity*" -exec cat {} \; 2>/dev/null
grep -rh "TeamCity (build" /home/*/.BuildServer/logs/teamcity-server.log 2>/dev/null | head -5

echo ""
echo "=== Listening ports (8111 default) ==="
ss -tlnp | grep -E ':(8111|443|8443|80)'

echo ""
echo "=== Firewall exposure of TeamCity listener ==="
iptables -L -n | grep 8111 2>/dev/null || echo "No iptables rules for 8111"

echo ""
echo "=== Suspicious files in TeamCity web/temp dirs (last 14 days) ==="
find /opt/TeamCity/webapps /opt/TeamCity/temp /opt/TeamCity/work \
  -type f \( -name "*.jsp" -o -name "*.sh" -o -name "*.py" \) -mtime -14 2>/dev/null

echo ""
echo "=== Recently modified files in TeamCity data directory ==="
find /home/*/.BuildServer/config -type f -mtime -14 2>/dev/null | head -40

echo ""
echo "=== New local users (last 30 days) ==="
find /etc/passwd -mtime -30 -exec grep -v nologin {} \; 2>/dev/null

echo ""
echo "REMINDER: Patch to the fixed TeamCity build per the JetBrains advisory, then rotate all credentials/secrets stored in TeamCity."

# CVE-2026-63077 triage for Windows-hosted TeamCity servers

Write-Output "=== TeamCity service status ==="
Get-Service | Where-Object { $_.DisplayName -like "*TeamCity*" } | Format-Table Name, Status, StartType -AutoSize

Write-Output "=== TeamCity version ==="
$versionFile = "C:\TeamCity\buildAgent\..\build.txt"
if (Test-Path $versionFile) { Get-Content $versionFile }
Get-ChildItem "C:\Program Files\JetBrains","C:\TeamCity" -Recurse -Filter "version.txt" -ErrorAction SilentlyContinue | ForEach-Object { Get-Content $_.FullName }

Write-Output "=== Network listeners (8111 default) ==="
Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -in 80,443,8111,8443 } | Format-Table LocalAddress, LocalPort, OwningProcess -AutoSize

Write-Output "=== Suspicious child processes of java (last 14 days, requires Sysmon) ==="
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'ParentImage.*java' -and $_.Message -match 'Image.*(cmd|powershell|pwsh|mshta|certutil)' } |
  Select-Object TimeCreated, Message | Format-List

Write-Output "=== Recently modified files in TeamCity web/temp directories ==="
Get-ChildItem "C:\TeamCity\webapps","C:\TeamCity\work","C:\TeamCity\temp" -Recurse -Include *.jsp,*.ps1,*.bat,*.exe -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
  Select-Object FullName, LastWriteTime | Format-Table -AutoSize

Write-Output "REMINDER: Apply the fixed TeamCity build per JetBrains, then rotate ALL credentials stored in TeamCity projects and global configuration."