T1059 Process Launched from the PeopleSoft PSEMHUB.war Directory

A process whose image, or whose command line, points into the PeopleSoft PSEMHUB.war application directory. UNC6240 (ShinyHunters) uploads its SIDEEYE backdoor loader, Ple64.exe, in chunks through the u.jsp web shell, then checks the file size, starts it with cmd.exe /c start /b "" applications\peoplesoft\PSEMHUB.war\Ple64.exe and polls tasklist | findstr /i Ple64 to confirm it is running. Ple64.exe masquerades as an EV-signed Light Alloy media player installer, so a signature check will pass it; the location gives it away, because nothing legitimate executes from inside a deployed web application archive. The command-line selection also catches the actor dir-listing and size-checking the payload before launch. Pair with the generic shell-from-java.exe rules for the fileless variant, which spawns cmd.exe or /bin/sh from the WebLogic Java process without writing anything.

Rule ID

0fdfbbe0-7d20-537e-a051-ab78f19781f9

Status

experimental

Level

high

Log source

category: process_creation

Date

2026-10-24

Modified

2026-10-24

ATT&CK

T1036 , T1059 (signal rollup)

Canonical YAML

t1059-peoplesoft-psemhub-payload-execution.yml

References

• https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/
• https://thrunt.me/hunt/shinyhunters/
• https://attack.mitre.org/techniques/T1059/

False positives

• PeopleTools deployment scripts that copy or unpack PSEMHUB.war name the directory on their command line. They run from the installer or from an administrator session during a change window, not from the WebLogic service account.

Rule YAML

title: 'T1059 Process Launched from the PeopleSoft PSEMHUB.war Directory'
id: '0fdfbbe0-7d20-537e-a051-ab78f19781f9'
status: 'experimental'
description: 'A process whose image, or whose command line, points into the PeopleSoft PSEMHUB.war application directory. UNC6240 (ShinyHunters) uploads its SIDEEYE backdoor loader, Ple64.exe, in chunks through the u.jsp web shell, then checks the file size, starts it with cmd.exe /c start /b "" applications\peoplesoft\PSEMHUB.war\Ple64.exe and polls tasklist | findstr /i Ple64 to confirm it is running. Ple64.exe masquerades as an EV-signed Light Alloy media player installer, so a signature check will pass it; the location gives it away, because nothing legitimate executes from inside a deployed web application archive. The command-line selection also catches the actor dir-listing and size-checking the payload before launch. Pair with the generic shell-from-java.exe rules for the fileless variant, which spawns cmd.exe or /bin/sh from the WebLogic Java process without writing anything.'
references:
    - 'https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/'
    - 'https://thrunt.me/hunt/shinyhunters/'
    - 'https://attack.mitre.org/techniques/T1059/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-10-24'
modified: '2026-10-24'
tags:
    - 'attack.execution'
    - 'attack.t1059'
    - 'attack.defense_evasion'
    - 'attack.t1036'
    - 'cve.2026-35273'
    - 'detection.emerging-threats'
    - 'tlp.clear'
logsource:
    category: 'process_creation'
detection:
    selection_image:
        Image|contains:
            - '\PSEMHUB.war\'
            - '/PSEMHUB.war/'
    selection_cmdline:
        CommandLine|contains:
            - '\PSEMHUB.war\'
            - '/PSEMHUB.war/'
    condition: 'selection_image or selection_cmdline'
falsepositives:
    - 'PeopleTools deployment scripts that copy or unpack PSEMHUB.war name the directory on their command line. They run from the installer or from an administrator session during a change window, not from the WebLogic service account.'
level: 'high'

The YAML file is the rule, and this page displays it. Scripts should read /sigma/manifest.json and fetch t1059-peoplesoft-psemhub-payload-execution.yml directly. The intel context for every rule is in /sigma/evidence.json, keyed by slug.