Suspicious Confluence Child Process Spawning cmd.exe or PowerShell on Windows

Alerts when Confluence/embedded Tomcat spawns cmd.exe or PowerShell on Windows, indicating possible command execution after exploitation.

FreeUnreviewedSigmamediumv1

suspicious-confluence-child-process-spawning-cmd-exe-or-powershell-on-windows-1ddaa9a4

title: Suspicious Confluence Child Process Spawning cmd.exe or PowerShell on Windows
id: ff661ad3-764c-4c11-b0d3-9ee7938acf03
related:
  - id: f8987c03-4290-4c96-870f-55e75ee377f4
    type: similar
  - id: 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
    type: derived
status: test
description: This rule flags Windows process creation where a Confluence-related parent process (tomcat8/9/10 running with a command line containing “confluence”) spawns a child process that is cmd.exe or PowerShell.exe. Attackers often use this kind of child process execution to run commands after gaining an initial foothold or exploiting a vulnerable Confluence endpoint. The detection relies on process creation telemetry, specifically parent image/command-line content and the child process executable/filename details.
references:
  - https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html
  - https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
  - https://github.com/ForceFledgling/CVE-2023-22518
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_win_exploit_cve_2023_22518_confluence_tomcat_child_proc.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-11-14
tags:
  - attack.execution
  - attack.t1059
  - attack.initial-access
  - attack.t1190
  - cve.2023-22518
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \tomcat8.exe
      - \tomcat9.exe
      - \tomcat10.exe
    ParentCommandLine|contains: confluence
  selection_child:
    - Image|endswith:
        - \cmd.exe
        - \powershell.exe
    - OriginalFileName:
        - Cmd.Exe
        - PowerShell.EXE
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process creation where a Confluence-related parent process (tomcat8/9/10 running with a command line containing “confluence”) spawns a child process that is cmd.exe or PowerShell.exe. Attackers often use this kind of child process execution to run commands after gaining an initial foothold or exploiting a vulnerable Confluence endpoint. The detection relies on process creation telemetry, specifically parent image/command-line content and the child process executable/filename details.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.