MediumSplunk security content Raven Tait +1

Windows Metasploit Confluence Plugin Execution

Detects the malicious java plugin execution used by metasploit for Atlassian Confluence exploitation. This usually leads to the download of meterpreter giving the actor full control over the Confluence server.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Linux macOS Network Devices PRE Windows
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.
Log source category: crowdstrike_processrollup2 sysmon_eventid_1 windows_event_log_security_4688

Known benign triggers

Some legitimate penetration testing tools or authorized security assessments may trigger this detection. Verify activity with your security team before taking action.

Detection rules

Windows Metasploit Confluence Plugin Execution

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules