From 3891cbcd0f222fdebb2aac548e99b0901312c004 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Sat, 4 Jun 2022 16:56:27 -0600
Subject: [PATCH] Update
 confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml

---
 ...nce_unauthenticated_remote_code_execution_cve_2022_26314.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml
index 30e4c42f3c..217c89eadb 100644
--- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml
+++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml
@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic assists with identifying CVE-2022-26314 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. 
   During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process.
 search: '| tstats count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*" 
+  as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*" Web.url="*org.apache.commons.io.IOUtils%40*")
   by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype
   | `drop_dm_object_name("Web")`
   | `security_content_ctime(firstTime)`