Linux: Process Creation Indicators for CVE-2023-22518 Confluence Exploitation via Java-Spawned Shell Tools

Alerts when Confluence Java spawns shell/download tools on Linux consistent with CVE-2023-22518 exploitation behavior.

FreeUnreviewedSigmahighv1

linux-process-creation-indicators-for-cve-2023-22518-confluence-exploitation-via-f8987c03

title: "Linux: Process Creation Indicators for CVE-2023-22518 Confluence Exploitation via Java-Spawned Shell Tools"
id: c484317d-e449-489e-83f6-611fed7394d9
related:
  - id: 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
    type: similar
  - id: f8987c03-4290-4c96-870f-55e75ee377f4
    type: derived
status: test
description: This rule flags exploitation attempts for CVE-2023-22518 by looking for child processes spawned from a Confluence Java process. Specifically, it matches Linux process creation events where the parent command line contains 'confluence' and the child image ends with common execution or download utilities such as bash, curl, echo, or wget. The behavior matters because successful exploitation may involve executing arbitrary commands or staging follow-on activity. Telemetry relies on process creation fields including parent image and command line, child image, and command-line content used to filter out benign activity involving 'ulimit -u'.
references:
  - https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html
  - https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
  - https://github.com/ForceFledgling/CVE-2023-22518
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_lnx_exploit_cve_2023_22518_confluence_java_child_proc.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-11-14
tags:
  - attack.execution
  - attack.t1059
  - attack.initial-access
  - attack.t1190
  - cve.2023-22518
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
    ParentCommandLine|contains: confluence
  selection_child:
    Image|endswith:
      - /bash
      - /curl
      - /echo
      - /wget
  filter_main_ulimit:
    CommandLine|contains: ulimit -u
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags exploitation attempts for CVE-2023-22518 by looking for child processes spawned from a Confluence Java process. Specifically, it matches Linux process creation events where the parent command line contains 'confluence' and the child image ends with common execution or download utilities such as bash, curl, echo, or wget. The behavior matters because successful exploitation may involve executing arbitrary commands or staging follow-on activity. Telemetry relies on process creation fields including parent image and command line, child image, and command-line content used to filter out benign activity involving 'ulimit -u'.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.