CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)

SigmaHQ Detections@sigmaHQ

•updated Jan 30, 2025•0•22

Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server, where an attacker can exploit vulnerable endpoints to create admin accounts and execute arbitrary commands. Specifically, this rule looks for suspicious child processes like cmd.exe or powershell.exe being spawned by Tomcat processes associated with Confluence.