Sigma high test sigma

Atlassian Confluence CVE-2022-26134

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

View Source

Detection Logic

{
  "selection": {
    "ParentImage
| startswith": "/opt/atlassian/confluence/",
    "ParentImage
| endswith": "/java",
    "CommandLine
| contains": [
      "/bin/sh",
      "bash",
      "dash",
      "ksh",
      "zsh",
      "csh",
      "fish",
      "curl",
      "wget",
      "python"
    ]
  },
  "condition": "selection"
}

False Positives

⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...