Linux Process Creation: Atlassian Confluence spawning shell/utility child processes

title: "Linux Process Creation: Atlassian Confluence spawning shell/utility child processes"
id: c50170ce-0b2e-4ef5-a8a4-9006727ccdcd
related:
  - id: 245f92e3-c4da-45f1-9070-bc552e06db11
    type: derived
  - id: 7fb14105-530e-4e2e-8cfb-99f7d8700b66
    type: derived
status: test
description: This rule flags Linux process creation where the parent process is within /opt/atlassian/confluence/ and ends with /java, and the child command line contains common scripting shells (sh, bash, dash, ksh, zsh, csh, fish) or utilities (curl, wget, python). Such behavior can indicate exploitation and follow-on execution initiated from an Atlassian Confluence server process. It relies on process_creation telemetry that includes the parent executable path and the child process command line.
references:
  - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-26134/proc_creation_lnx_exploit_cve_2022_26134_atlassian_confluence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-03
tags:
  - attack.initial-access
  - attack.execution
  - attack.t1190
  - attack.t1059
  - cve.2022-26134
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|startswith: /opt/atlassian/confluence/
    ParentImage|endswith: /java
    CommandLine|contains:
      - /bin/sh
      - bash
      - dash
      - ksh
      - zsh
      - csh
      - fish
      - curl
      - wget
      - python
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1