Atlassian Confluence CVE-2022-26134

Title: Atlassian Confluence CVE-2022-26134
Status: test
Description:Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134
References:
  -https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-03
modified:None
Tags:

• -'attack.initial-access'
• -'attack.execution'
• -'attack.t1190'
• -'attack.t1059'
• -'cve.2022-26134'

Logsource:

• category: process_creation
• product: linux

Detection:
  selection:
    ParentImage|startswith: '/opt/atlassian/confluence/'
    ParentImage|endswith: '/java'
    CommandLine|contains:
      -'/bin/sh'
      -'bash'
      -'dash'
      -'ksh'
      -'zsh'
      -'csh'
      -'fish'
      -'curl'
      -'wget'
      -'python'

  condition:selection
Falsepositives:
  -Unknown
Level: high