CVE-2023-22518 Confluence Exploitation Attempt via Suspicious Bash/Curl/Wget Child Processes on Linux
Alerts when Confluence Java spawns shell/download tools on Linux consistent with CVE-2023-22518 exploitation behavior.
- Product
- linux
- Category
- process_creation
- Author
- Andreas Braathen (mnemonic.io) (SigmaHQ), DRL 1.1
- Published
- 2023-11-14
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies potential exploitation of CVE-2023-22518 by looking for a Confluence-related parent process on Linux that spawns suspicious command-line utilities. Attackers may use these utilities to run attacker-controlled commands during exploitation. The detection relies on Linux process creation telemetry, specifically parent image and command line context plus child process image names, and filters out cases containing 'ulimit -u'.
Reporting behind it
- confluence.atlassian.comhttps://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html
- huntress.comhttps://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
- github.comhttps://github.com/ForceFledgling/CVE-2023-22518
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_lnx_exploit_cve_2023_22518_confluence_java_child_proc.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: CVE-2023-22518 Confluence Exploitation Attempt via Suspicious Bash/Curl/Wget Child Processes on Linux
id: c484317d-e449-489e-83f6-611fed7394d9
related:
- id: 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
type: similar
- id: f8987c03-4290-4c96-870f-55e75ee377f4
type: derived
status: test
description: This rule identifies potential exploitation of CVE-2023-22518 by looking for a Confluence-related parent process on Linux that spawns suspicious command-line utilities. Attackers may use these utilities to run attacker-controlled commands during exploitation. The detection relies on Linux process creation telemetry, specifically parent image and command line context plus child process image names, and filters out cases containing 'ulimit -u'.
references:
- https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html
- https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
- https://github.com/ForceFledgling/CVE-2023-22518
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_lnx_exploit_cve_2023_22518_confluence_java_child_proc.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-11-14
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
- cve.2023-22518
- detection.emerging-threats
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
ParentCommandLine|contains: confluence
selection_child:
Image|endswith:
- /bash
- /curl
- /echo
- /wget
filter_main_ulimit:
CommandLine|contains: ulimit -u
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1