Cisco ISE Java Spawning a Root Shell or Utility (Experimental)
Experimental behavioral hunt for a Java process directly spawning a root-owned shell or selected command-line utility on explicitly inventoried ISE devices. Potential post-exploitation signal relevant to ISE Java RCE investigations. It does not prove Java deserialization or identify CVE-2026-20307/20211, and requires verified appliance process telemetry.
Microsoft Sentinel (KQL)
