Emerging Threathightest

Potential CVE-2021-26084 Exploitation Attempt

Detects potential exploitation of CVE-2021-260841 a Confluence RCE using OGNL injection

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Sittikorn S, Nuttakorn TCreated Tue Dec 13Updated Fri Mar 2438825179-3c78-4fed-b222-2e2166b926b12021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Definition

Requirements: The POST request body data must be collected in order to make use of certain parts of this detection

Detection Logic

detection:
    selection_main:
        cs-method: 'POST'
        sc-status: 200
        cs-username: 'anonymous' # This string is used to reduce possible FP you could remove it to get authenticated attempts
    selection_exploit_1:
        cs-uri-query|contains|all:
            - '/pages/createpage-entervariables.action'
            - 'SpaceKey=x' # This URI assume that you can't have a space ID of "X"
    selection_exploit_2_uri:
        cs-uri-query|contains: '/doenterpagevariables.action'
    selection_exploit_2_keyword:
        - 'u0027' # This string should appear in the post body as a value of the parameter "queryString"
    condition: selection_main and (selection_exploit_1 or all of selection_exploit_2_*)