Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•23

Detects the spawning of suspicious child processes by the Atlassian Confluence server, which may indicate successful exploitation of CVE-2021-26084. The rule specifically looks for the Confluence Java process spawning common command-line utilities and scripting interpreters often used in post-exploitation activities.