
title: Atlassian Confluence CVE-2021-26084
author: Bhabesh Raj
date: 2021/09/08
description: Detects spawning of suspicious child processes by Atlassian Confluence
  server which may indicate successful exploitation of CVE-2021-26084
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    ParentImage: '*\Atlassian\Confluence\jre\bin\java.exe'
  SELECTION_3:
    CommandLine:
    - '*cmd /c*'
    - '*cmd /k*'
    - '*powershell*'
    - '*certutil*'
    - '*curl*'
    - '*whoami*'
    - '*ipconfig*'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
falsepositives:
- Unknown
id: 245f92e3-c4da-45f1-9070-bc552e06db11
level: high
logsource:
  category: process_creation
  product: windows
references:
- https://nvd.nist.gov/vuln/detail/CVE-2021-26084
- https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
- https://github.com/h3v0x/CVE-2021-26084_Confluence
status: experimental
tags:
- attack.initial_access
- attack.execution
- attack.t1190
- attack.t1059
ruletype: SIGMA
