huntrule

Linux process creation: Confluence Java spawning script or download utilities

Alerts when Confluence’s Java process on Linux spawns shell or scripting/utilities, consistent with potential CVE-driven command execution.

FreeReviewedSigma · High · v5
Product
linux
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-03
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access → Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux process creation events where an Atlassian Confluence server Java process (under /opt/atlassian/confluence/ and ending with /java) spawns a child process with a command line containing common shell interpreters or scripting/downloading tools. Such behavior can indicate post-exploitation activity where an attacker executes commands or pulls additional payloads. It relies on process_creation telemetry including ParentImage and CommandLine for the spawned child process.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange
Possible Ivanti Pulse Connect Secure Command Injection via License Keys-Status Endpoint (via webserver)
Possible Craft CMS RCE via Query-String CLI Option Injection
Possible Aspera Faspex Pre-Auth RCE via YAML Deserialization in package_relay (via webserver)
Possible Sitecore Pre-Auth RCE via Report.ashx Insecure Deserialization (via webserver)
Possible WatchGuard Pre-Auth RCE via agent login XML-RPC CVE-2022-26318
Possible Oracle Opera CGI Webshell Command Execution via operabin
Suspicious PHP Stream Wrapper in Query-String CLI Argument
Possible Sitecore Experience Platform Pre-Auth RCE via TypeConfuseDelegate Gadget (via webserver)
Possible SSTI Remote Command Execution from Web Application Process
Linux process creation: Confluence Java spawning script or download utilities
Pivot detection · T1059 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.