Windows Process Creation: Atlassian Confluence Java Spawns Suspicious Utility Child Processes (CVE-2021-26084)
Flags suspicious child processes spawned by Confluence’s Java on Windows, consistent with attempted CVE-2021-26084 exploitation.
- Product
- windows
- Category
- process_creation
- Author
- Bhabesh Raj (SigmaHQ), DRL 1.1
- Published
- 2021-09-08
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process creation events where Atlassian Confluence’s bundled java.exe spawns a child process with command-line indicators consistent with common exploitation and post-exploitation utilities. Such behavior matters because successful exploitation often results in execution of external tools and command interpreters via the Confluence server process. The detection relies on process creation telemetry, specifically parent image path ending with Confluence java.exe and child process command-line substrings for utilities like certutil, PowerShell, curl, and related binaries.
Reporting behind it
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-26084
- confluence.atlassian.comhttps://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
- github.comhttps://github.com/h3v0x/CVE-2021-26084_Confluence
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26084/proc_creation_win_exploit_cve_2021_26084_atlassian_confluence.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Atlassian Confluence Java Spawns Suspicious Utility Child Processes (CVE-2021-26084)"
id: 3ed72365-0cde-45d4-b440-c2b2bb31a2d6
status: test
description: This rule identifies Windows process creation events where Atlassian Confluence’s bundled java.exe spawns a child process with command-line indicators consistent with common exploitation and post-exploitation utilities. Such behavior matters because successful exploitation often results in execution of external tools and command interpreters via the Confluence server process. The detection relies on process creation telemetry, specifically parent image path ending with Confluence java.exe and child process command-line substrings for utilities like certutil, PowerShell, curl, and related binaries.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2021-26084
- https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
- https://github.com/h3v0x/CVE-2021-26084_Confluence
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26084/proc_creation_win_exploit_cve_2021_26084_atlassian_confluence.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-09-08
modified: 2023-02-13
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
- cve.2021-26084
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \Atlassian\Confluence\jre\bin\java.exe
CommandLine|contains:
- certutil
- cmd /c
- cmd /k
- cscript
- curl
- ipconfig
- powershell
- pwsh
- regsvr32
- rundll32
- whoami
- wscript
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 245f92e3-c4da-45f1-9070-bc552e06db11
type: derived