Windows: Detects Suspicious cmd.exe or PowerShell spawned from Confluence (tomcat) Processes
Alerts when Confluence/embedded Tomcat spawns cmd.exe or PowerShell on Windows, indicating possible command execution after exploitation.
- Product
- windows
- Category
- process_creation
- Author
- Andreas Braathen (mnemonic.io) (SigmaHQ), DRL 1.1
- Published
- 2023-11-14
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags exploitation attempts associated with CVE-2023-22518 by detecting Windows process chains where a Confluence-related Tomcat parent process spawns a child command interpreter. Attackers commonly use cmd.exe or PowerShell to execute attacker-controlled commands after reaching a vulnerable Confluence endpoint. The detection relies on process creation telemetry, matching parent image/command line patterns for Confluence within Tomcat and child process names/images ending in cmd.exe or PowerShell.exe.
Reporting behind it
- confluence.atlassian.comhttps://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html
- huntress.comhttps://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
- github.comhttps://github.com/ForceFledgling/CVE-2023-22518
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_win_exploit_cve_2023_22518_confluence_tomcat_child_proc.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detects Suspicious cmd.exe or PowerShell spawned from Confluence (tomcat) Processes"
id: ff661ad3-764c-4c11-b0d3-9ee7938acf03
related:
- id: f8987c03-4290-4c96-870f-55e75ee377f4
type: similar
- id: 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
type: derived
status: test
description: This rule flags exploitation attempts associated with CVE-2023-22518 by detecting Windows process chains where a Confluence-related Tomcat parent process spawns a child command interpreter. Attackers commonly use cmd.exe or PowerShell to execute attacker-controlled commands after reaching a vulnerable Confluence endpoint. The detection relies on process creation telemetry, matching parent image/command line patterns for Confluence within Tomcat and child process names/images ending in cmd.exe or PowerShell.exe.
references:
- https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html
- https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment
- https://github.com/ForceFledgling/CVE-2023-22518
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-22518/proc_creation_win_exploit_cve_2023_22518_confluence_tomcat_child_proc.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-11-14
tags:
- attack.execution
- attack.t1059
- attack.initial-access
- attack.t1190
- cve.2023-22518
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \tomcat8.exe
- \tomcat9.exe
- \tomcat10.exe
ParentCommandLine|contains: confluence
selection_child:
- Image|endswith:
- \cmd.exe
- \powershell.exe
- OriginalFileName:
- Cmd.Exe
- PowerShell.EXE
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1