Emerging Threats
CVE2023

CVE-2023-22518

4Rules
3References
1Folders
2023-11-14Latest
Summary

CVE-2023-22518 is tracked here through 4 Sigma detections for exploitation attempts and related post-exploitation behavior observed in 2023. Coverage centers on linux / process_creation, proxy, webserver +1.

Related Detections
Search this threat
Emerging Threathightest

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

LinuxProcess Creation
TA0002 · ExecutionT1059 · Command and Scripting InterpreterTA0001 · Initial AccessT1190 · Exploit Public-Facing Application+2
Andreas Braathen (mnemonic.io)Tue Nov 142023
Emerging Threatmediumtest

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

WindowsProcess Creation
TA0002 · ExecutionT1059 · Command and Scripting InterpreterTA0001 · Initial AccessT1190 · Exploit Public-Facing Application+2
Andreas Braathen (mnemonic.io)Tue Nov 142023
Emerging Threatmediumtest

CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Proxy Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2023-22518detection.emerging-threats
Andreas Braathen (mnemonic.io)Tue Nov 142023
Emerging Threatmediumtest

CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2023-22518detection.emerging-threats
Andreas Braathen (mnemonic.io)Tue Nov 142023
References