SUSP_EXPL_Confluence_RCE_CVE_2021_26084_Indicators_Sep21

rule SUSP_EXPL_Confluence_RCE_CVE_2021_26084_Indicators_Sep21 {
   meta:
      description = "Detects ELF binaries owner by the confluence user but outside usual confluence directories"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://attackerkb.com/topics/Eu74wdMbEL/cve-2021-26084-confluence-server-ognl-injection/rapid7-analysis"
      date = "2021-09-01"
      score = 55
      id = "395d37ea-1986-5fdd-b58c-562ae0d8be35"
   condition:
      uint32be(0) == 0x7f454c46  /* ELF binary */
      and owner == "confluence"
      and not filepath contains "/confluence/"
}