atlassian_confluence_ip_iocs.yml

AnalysisType: rule
Filename: atlassian_confluence_ip_iocs.py
RuleID: "Confluence.0DayIPs"
DisplayName: "Confluence 0-Day Indicators of Compromise (IOCs)"
Enabled: True
LogTypes:
  - AWS.ALB
  - AWS.CloudTrail
  - AWS.GuardDuty
  - AWS.S3ServerAccess
  - AWS.VPCFlow
  - GCP.AuditLog
  - Apache.AccessCombined
  - Apache.AccessCommon
  - Cloudflare.Firewall
  - Cloudflare.HttpRequest
  - Juniper.Access
  - Nginx.Access
Tags:
  - AWS
  - DNS
  - GCP
  - Apache
  - Cloudflare
  - Nginx
  - Juniper
  - Deprecated
Severity: High
Description: >
  Detects IP addresses observed exploiting the 0-Day CVE-2022-26134
Reference: >
  https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
  https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
Runbook: >
  Investigate traffic from these IP addresses and look for other IOCs associated with the 0-Day exploit CVE-2022-26134
SummaryAttributes:
  - p_any_domain_names
  - p_any_ip_addresses
Tests:
  - Name: Non-matching traffic
    ExpectedResult: false
    Log:
      {
        "dstport": 53,
        "dstaddr": "1.1.1.1",
        "srcaddr": "10.0.0.1",
        "p_any_ip_addresses": ["1.1.1.1"],
      }
  - Name: Indicator of Compromise (IP) Detected
    ExpectedResult: true
    Log:
      {
        "srcaddr": "59.163.248.170",
        "dstaddr": "0.0.0.1",
        "p_any_ip_addresses": ["59.163.248.170"],
      }