Phoenix
Sigma IntelligenceBeta
Back to Rules
Emerging Threatcriticaltest

Confluence Exploitation CVE-2019-3398

Detects the exploitation of the Confluence vulnerability described in CVE-2019-3398

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems)Created Tue May 26Updated Mon Jan 02e9bc39ae-978a-4e49-91ab-5bd481fc668b2019
Emerging Threat
Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source
Web Server Log
CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains|all:
            - '/upload.action'
            - 'filename=../../../../'
    condition: selection
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
devcentral.f5.com
MITRE ATT&CK

Other

cve.2019-3398detection.emerging-threats
Rule Metadata
Rule ID
e9bc39ae-978a-4e49-91ab-5bd481fc668b
Status
test
Level
critical
Type
Emerging Threat
Created
Tue May 26
Modified
Mon Jan 02
Author
Florian Roth (Nextron Systems)
Path
rules-emerging-threats/2019/Exploits/CVE-2019-3398/web_cve_2019_3398_confluence.yml
Raw Tags
attack.initial-accessattack.t1190cve.2019-3398detection.emerging-threats
View on GitHub