Atlassian Confluence CVE-2022-26134 Post-Exploitation Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•26

Detects the spawning of suspicious child processes by an Atlassian Confluence server, specifically looking for shell interpreters (sh, bash, dash, ksh, zsh, csh, fish), curl, wget, or python being executed as child processes of the Confluence Java process. This behavior is indicative of successful exploitation of CVE-2022-26134, a critical remote code execution vulnerability in Atlassian Confluence. The rule focuses on the post-exploitation phase where an attacker would execute commands on the compromised server.