Adding analytics for CVE-2023-22518

[netgrain]

Summary of the Pull Request

Adds analytics to detect suspicious activity related to the exploitation of CVE-2023-22518, incl. known vulnerable endpoints.

Observations based on non-public incidents and tested in a real-world environment.

https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html

Changelog

new: CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux)
new: CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows)
new: CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Proxy)
new: CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver)

Example Log Event

https://www.rapid7.com/blog/post/2023/11/06/etr-rapid7-observed-exploitation-of-atlassian-confluence-cve-2023-22518/

Network

[05/Nov/2023:11:54:54 +0000] - SYSTEMNAME 193.176.179[.]41 POST /json/setup-restore.action?synchronous=true HTTP/1.1 302 44913ms - - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
[05/Nov/2023:11:56:09 +0000] admin SYSTEMNAME 193.176.179[.]41 GET /rest/plugins/1.0/?os_authType=basic HTTP/1.1 200 153ms 388712 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Endpoint (Windows)

"DRIVE:\Confluence\Confluence\bin\tomcat9.exe" "//RS//Confluence"
cmd /c whoami

Endpoint (Linux)

/opt/atlassian/confluence/jre//bin/java
/usr/bin/bash -c whoami

[nasbench]

Thanks for this PR @netgrain

I added another variant using the proxy logsource to cover for proxy or waf's. I also reduced the windows version of the child process rule to medium as to my experience. I've seen Java spawn cmd quite often in some cases.

Cheers.

[netgrain]

Thanks for this PR @netgrain

I added another variant using the proxy logsource to cover for proxy or waf's. I also reduced the windows version of the child process rule to medium as to my experience. I've seen Java spawn cmd quite often in some cases.

Cheers.

Excellent @nasbench!

Seems like a good solution. And yeah, quite a few odd cases with legitimate process spawning via Java (and even Tomcat).