CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•29

Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server. This vulnerability allows an attacker to create admin accounts and execute arbitrary commands. The rule specifically looks for suspicious child processes like bash, curl, or wget being spawned by the Confluence Java process.