Windows: Detect Atlassian Confluence Java spawning suspicious child processes (CVE-2021-26084)

title: "Windows: Detect Atlassian Confluence Java spawning suspicious child processes (CVE-2021-26084)"
id: 3ed72365-0cde-45d4-b440-c2b2bb31a2d6
status: test
description: This rule identifies Windows process creation events where Atlassian Confluence's bundled Java (jre\bin\java.exe) spawns a child process whose command line contains common utility, scripting, or system discovery tools. Such behavior can indicate an exploitation workflow where the attacker leverages OS command execution from Confluence. Detection relies on process creation telemetry, specifically the parent process image ending in the Confluence Java path and the child command line substrings (e.g., certutil, powershell/pwsh, cmd /c, curl, whoami, regsvr32).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2021-26084
  - https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
  - https://github.com/h3v0x/CVE-2021-26084_Confluence
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26084/proc_creation_win_exploit_cve_2021_26084_atlassian_confluence.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-09-08
modified: 2023-02-13
tags:
  - attack.initial-access
  - attack.execution
  - attack.t1190
  - attack.t1059
  - cve.2021-26084
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \Atlassian\Confluence\jre\bin\java.exe
    CommandLine|contains:
      - certutil
      - cmd /c
      - cmd /k
      - cscript
      - curl
      - ipconfig
      - powershell
      - pwsh
      - regsvr32
      - rundll32
      - whoami
      - wscript
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 245f92e3-c4da-45f1-9070-bc552e06db11
    type: derived