Critical RCE in 8 Atlassian Products Actively Exploited in the Wild — Detection and Remediation Guide for Jira and Confluence Defenders

---
title: Atlassian Java Process Spawning Shell or Script Interpreter
id: 9f2e7a41-3c8b-4d5e-a6f1-7b2c9d4e5f01
status: experimental
description: Detects the Atlassian JVM (java process under confluence/jira user) spawning shells, download tools, or script interpreters — a high-fidelity indicator of RCE exploitation against Jira/Confluence.
references:
  - https://www.infosecurity-magazine.com/news/critical-vulnerability-atlassian/
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/java.exe'
  selection_parent_user:
    ParentUser|contains:
      - 'confluence'
      - 'jira'
      - 'atlassian'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and (selection_parent_user or selection_parent) and selection_child
falsepositives:
  - Rare — legitimate Atlassian plugins executing scripts. Investigate every hit.
level: critical
---
title: Atlassian Tomcat Process Spawning Command Shell on Windows
id: 2b8d4e6f-1a3c-5e7b-9d2f-4c6a8e0b1d3f
status: experimental
description: Detects the Atlassian Tomcat/Java service spawning cmd.exe or PowerShell on Windows-hosted Jira/Confluence instances, consistent with web application RCE.
references:
  - https://www.infosecurity-magazine.com/news/critical-vulnerability-atlassian/
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059.003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\tomcat9.exe'
      - '\tomcat10.exe'
      - '\commons-daemon.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Very rare on Atlassian hosts — any hit warrants investigation.
level: critical
---
title: Webshell Dropped in Atlassian Installation or Temp Directory
id: 5c1f9a3b-7e2d-4f8a-b6c3-8d0e2f4a6b8c
status: experimental
description: Detects creation of JSP/script files in Atlassian Tomcat web directories or temp paths, indicating webshell deployment following exploitation of Jira/Confluence.
references:
  - https://www.infosecurity-magazine.com/news/critical-vulnerability-atlassian/
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.initial_access
  - attack.t1190
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/atlassian/jira/temp/'
      - '/atlassian/confluence/temp/'
      - '/atlassian-jira/'
      - '/confluence/'
      - '/tomcat/webapps/'
      - '/dev/shm/'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.sh'
      - '.elf'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate plugin deployments create JSPs — correlate with change windows and the writing process (java writing JSPs outside a deployment event is suspicious).
level: high

// Hunt: Atlassian JVM spawning shells/interpreters across Linux hosts (via Syslog/Auditd ingestion)
// and Windows-hosted Jira/Confluence via Defender process events.
// Run over the last 14 days; any hit on an Atlassian host is a P1 investigation.

// Linux hosts (Syslog or Auditd via AMA/CEF)
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName =~ "java"
   or SyslogMessage has_any ("confluence", "jira", "atlassian")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "python", "perl", "base64 -d")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SeverityLevel
| order by TimeGenerated desc
;

// Windows-hosted Atlassian instances (Defender for Endpoint)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("java.exe", "tomcat9.exe", "tomcat10.exe", "commons-daemon.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "bitsadmin.exe", "wscript.exe", "cscript.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc
;

// Network egress from Atlassian hosts to rare external destinations (payload staging)
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "java.exe"
| where RemotePort in (80, 443, 8080, 8443)
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, RemoteIP, RemoteUrl, RemotePort
| where ConnectionCount < 20  // low-volume egress is more suspicious from a web app JVM
| order by FirstSeen asc

-- Hunt artifact: Atlassian RCE indicators — shells under the JVM, staged payloads, and webshells
-- Deploy against all Jira/Confluence Data Center/Server nodes.

-- 1) Java/Tomcat processes with shell-like children or suspicious command lines
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)java|tomcat' AND Username =~ '(?i)confluence|jira|atlassian')
   OR CommandLine =~ '(?i)(/bin/(ba)?sh|curl |wget |python|perl|base64 -d|cmd.exe|powershell)'

-- 2) Recently created executable/script artifacts in Atlassian temp and shared-memory paths
SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=['/var/atlassian/**/temp/*.sh', '/var/atlassian/**/temp/*.jsp',
                 '/opt/atlassian/**/temp/*.sh', '/opt/atlassian/**/temp/*.jsp',
                 '/dev/shm/*', '/tmp/*.sh', '/tmp/*.elf'])
WHERE Mtime > now() - 1209600  -- last 14 days

-- 3) Outbound connections owned by the JVM (payload staging / C2)
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, State
FROM netstat()
WHERE Name =~ '(?i)java'
  AND State =~ 'ESTABLISHED'
  AND NOT RemoteAddr =~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)'

#!/bin/bash
# atlassian-harden-verify.sh — Verification and containment helper for Jira/Confluence DC/Server nodes.
# Run as root on each Atlassian host. Read-only checks plus optional containment flags.
# 1) Identify Atlassian version and install state
echo "=== Atlassian Version Inventory ==="
for f in /opt/atlassian/*/atlassian-*-*/WEB-INF/classes/com/atlassian/*/buildinfo.properties \
         /var/atlassian/application-data/*/buildinfo.properties; do
  [ -f "$f" ] && echo "--- $f" && grep -E 'version|build' "$f"
done 2>/dev/null

# 2) Hunt: java processes with shell children (live indicator of exploitation)
echo "=== Suspicious child processes of the Atlassian JVM ==="
for pid in $(pgrep -u confluence java; pgrep -u jira java); do
  ps --ppid "$pid" -o pid,ppid,user,comm,args 2>/dev/null
  pstree -ap "$pid" 2>/dev/null | grep -E 'sh|bash|curl|wget|python|perl|nc'
done

# 3) Hunt: recently modified JSP/scripts in install and temp directories (webshell staging)
echo "=== Recent script artifacts in Atlassian paths (last 14 days) ==="
find /opt/atlassian /var/atlassian -type f \( -name '*.jsp' -o -name '*.sh' -o -name '*.elf' \) -mtime -14 -ls 2>/dev/null
find /tmp /dev/shm -type f -mtime -14 -ls 2>/dev/null

# 4) Hunt: unexpected outbound connections from the JVM
echo "=== Established outbound connections from java ==="
ss -tnp 2>/dev/null | grep java | grep ESTAB

# 5) Hunt: new persistence (cron/systemd) for atlassian service accounts
echo "=== Persistence check: cron and systemd units ==="
crontab -l -u confluence 2>/dev/null; crontab -l -u jira 2>/dev/null
ls -la /etc/systemd/system/ | grep -iE 'atlassian|jira|confluence'
grep -rE 'curl|wget|bash -i|/dev/tcp' /etc/cron* /var/spool/cron 2>/dev/null

# 6) Verify ingress exposure: is the instance reachable from the internet?
echo "=== Listener check (Tomcat 8080/8443/8009) ==="
ss -tlnp 2>/dev/null | grep -E ':8080|:8443|:8009'

echo ""
echo "NEXT STEPS:"
echo "[1] Confirm installed version against Atlassian Security Advisories:"
echo "    https://confluence.atlassian.com/security/security-bulletins-1716549380.html"
echo "[2] If unpatched: patch IMMEDIATELY to the fixed version listed in the advisory."
echo "[3] If any suspicious child process or artifact found: isolate the host, memory-capture first, then IR."
echo "[4] If you cannot patch today: restrict the listener to internal/VPN source IPs via host firewall or WAF."