title: 'T1059 Process Launched from the PeopleSoft PSEMHUB.war Directory'
id: '0fdfbbe0-7d20-537e-a051-ab78f19781f9'
status: 'experimental'
description: 'A process whose image, or whose command line, points into the PeopleSoft PSEMHUB.war application directory. UNC6240 (ShinyHunters) uploads its SIDEEYE backdoor loader, Ple64.exe, in chunks through the u.jsp web shell, then checks the file size, starts it with cmd.exe /c start /b "" applications\peoplesoft\PSEMHUB.war\Ple64.exe and polls tasklist | findstr /i Ple64 to confirm it is running. Ple64.exe masquerades as an EV-signed Light Alloy media player installer, so a signature check will pass it; the location gives it away, because nothing legitimate executes from inside a deployed web application archive. The command-line selection also catches the actor dir-listing and size-checking the payload before launch. Pair with the generic shell-from-java.exe rules for the fileless variant, which spawns cmd.exe or /bin/sh from the WebLogic Java process without writing anything.'
references:
    - 'https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/'
    - 'https://thrunt.me/hunt/shinyhunters/'
    - 'https://attack.mitre.org/techniques/T1059/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-10-24'
modified: '2026-10-24'
tags:
    - 'attack.execution'
    - 'attack.t1059'
    - 'attack.defense_evasion'
    - 'attack.t1036'
    - 'cve.2026-35273'
    - 'detection.emerging-threats'
    - 'tlp.clear'
logsource:
    category: 'process_creation'
detection:
    selection_image:
        Image|contains:
            - '\PSEMHUB.war\'
            - '/PSEMHUB.war/'
    selection_cmdline:
        CommandLine|contains:
            - '\PSEMHUB.war\'
            - '/PSEMHUB.war/'
    condition: 'selection_image or selection_cmdline'
falsepositives:
    - 'PeopleTools deployment scripts that copy or unpack PSEMHUB.war name the directory on their command line. They run from the installer or from an administrator session during a change window, not from the WebLogic service account.'
level: 'high'