Emerging Threathightest

Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Bhabesh RajCreated Wed Sep 08Updated Mon Feb 13245f92e3-c4da-45f1-9070-bc552e06db112021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        # Monitor suspicious child processes spawned by Confluence
        ParentImage|endswith: '\Atlassian\Confluence\jre\bin\java.exe'
        CommandLine|contains:
            - 'certutil'
            - 'cmd /c'
            - 'cmd /k'
            - 'cscript'
            - 'curl'
            - 'ipconfig'
            - 'powershell'
            - 'pwsh'
            - 'regsvr32'
            - 'rundll32'
            - 'whoami'
            - 'wscript'
    condition: selection