huntrule

Linux process creation: Confluence Java spawning script or download utilities

Alerts when Confluence’s Java process on Linux spawns shell or scripting/utilities, consistent with potential CVE-driven command execution.

FreeReviewedSigma · High · v5
Product
linux
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-03
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access → Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux process creation events where an Atlassian Confluence server Java process (under /opt/atlassian/confluence/ and ending with /java) spawns a child process with a command line containing common shell interpreters or scripting/downloading tools. Such behavior can indicate post-exploitation activity where an attacker executes commands or pulls additional payloads. It relies on process_creation telemetry including ParentImage and CommandLine for the spawned child process.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange
Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)
Suspicious Reconnaissance and Payload Download by Node Web Process
Malicious Text4Shell Apache Commons Text Interpolation Payload in HTTP Request
Possible Apache ActiveMQ RCE via Jolokia addNetworkConnector (via webserver)
Possible LiteLLM Unauthenticated Command Execution via MCP Test Endpoints (via webserver)
Possible Ivanti Cloud Services Appliance Command Injection via datetime.php (via webserver)
Possible Log4Shell Exploitation via Java Spawning Shell or Download Utility
Possible Ivanti Pulse Connect Secure Command Injection via License Keys-Status Endpoint (via webserver)
Possible Craft CMS RCE via Query-String CLI Option Injection
Linux process creation: Confluence Java spawning script or download utilities
Pivot detection · T1059 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.