admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml

Browse Source
This commit is contained in:
mhaag-spl
2022-06-04 16:56:27 -06:00
parent 05cd8a648d
commit 3891cbcd0f
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml
+1 -1
View File
@@ -9,7 +9,7 @@ datamodel:
description: The following analytic assists with identifying CVE-2022-26314 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7.
During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process.
search: '| tstats count min(_time) as firstTime max(_time)
as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*"
as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*" Web.url="*org.apache.commons.io.IOUtils%40*")
by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype
| `drop_dm_object_name("Web")`
| `security_content_ctime(firstTime)`