Windows Metasploit Confluence Plugin Execution
Detects the execution of a malicious Java process spawned by the Metasploit Confluence plugin, which is often used for remote code execution (RCE) via Confluence vulnerabilities. The rule looks for java.exe spawned from the Confluence directory with specific command-line arguments containing a classpath pointing to the user's Temp folder with a ~spawn prefix and a Payload class.
Sigma
