id: CVE-2022-26134 - Confluence RCE version: -1 name: CVE-2022-26134 - Confluence RCE description: "Atlassian has been made aware of the current active exploitation of a critical severity unauthenticated remote code execution vulnerability in Confluence Data Center and Server. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance. \n\n**All** versions of Confluence Server and Data Center prior to the fixed versions listed above are affected by this vulnerability.\n\nAtlassian has released the following versions to address this issue:\n\n**Released versions 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4, and 7.18.1 which contain a fix for this issue.**\n\nThis playbook includes the following tasks:\n\n* Collect detection rules.\n* Exploitation patterns & IoCs hunting using PANW Next-Generation Firewalls and 3rd party SIEM products.\n* Cortex Xpanse policies coverage.\n* Provides Atlassian workarounds and patched versions.\n\n**More information:**\n\n[Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022-26134)\n](https://unit42.paloaltonetworks.com/cve-2022-26134-atlassian-code-execution-vulnerability/)\n[Confluence Security Advisory 2022-06-02](https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html)\n\n**Note:** This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve." starttaskid: '0' tasks: '0': id: '0' taskid: 39fa11f8-a927-4538-862a-5f4311f8afe2 type: start task: id: 39fa11f8-a927-4538-862a-5f4311f8afe2 version: -1 name: '' iscommand: false brand: '' description: '' nexttasks: '#none#': - '13' - '1' separatecontext: false view: |- { "position": { "x": 450, "y": 130 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '1': id: '1' taskid: f38c7116-69ac-418f-84d6-578369ad170c type: title task: id: f38c7116-69ac-418f-84d6-578369ad170c version: -1 name: Collect Indicators type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '15' - '14' separatecontext: false view: |- { "position": { "x": 880, "y": 280 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '5': id: '5' taskid: fdce366d-1ad0-4886-8e93-72c1574861f7 type: title task: id: fdce366d-1ad0-4886-8e93-72c1574861f7 version: -1 name: Extract Indicators type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '6' separatecontext: false view: |- { "position": { "x": 450, "y": 600 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '6': id: '6' taskid: 30c02429-1a36-4177-8a1a-9dd125275a67 type: regular task: id: 30c02429-1a36-4177-8a1a-9dd125275a67 version: -1 name: Extract Indicators From Data Collected description: commands.local.cmd.extract.indicators script: Builtin|||extractIndicators type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '7' scriptarguments: text: complex: root: http.parsedBlog accessor: indicators separatecontext: false continueonerror: true view: |- { "position": { "x": 450, "y": 730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '7': id: '7' taskid: ac9a826b-c423-4aca-8bb4-8ca05d267690 type: title task: id: ac9a826b-c423-4aca-8bb4-8ca05d267690 version: -1 name: Tag and Link Indicators type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '9' - '10' - '16' separatecontext: false view: |- { "position": { "x": 450, "y": 890 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '8': id: '8' taskid: a52aace6-d4eb-483d-81c1-c4590ec2d3b8 type: regular task: id: a52aace6-d4eb-483d-81c1-c4590ec2d3b8 version: -1 name: Link Indicators To Incident description: commands.local.cmd.associate.indicators script: Builtin|||associateIndicatorsToIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '36' scriptarguments: incidentId: complex: root: incident accessor: id indicatorsValues: complex: root: ExtractedIndicators.IP filters: - - operator: isNotEmpty left: value: simple: ExtractedIndicators.IP iscontext: true transformers: - operator: append args: item: value: simple: ExtractedIndicators.Domain iscontext: true - operator: append args: item: value: simple: ExtractedIndicators.URL iscontext: true - operator: append args: item: value: simple: ExtractedIndicators.CVE iscontext: true - operator: append args: item: value: simple: ExtractedIndicators.File iscontext: true separatecontext: false view: |- { "position": { "x": 450, "y": 1200 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '9': id: '9' taskid: 421c9a36-2621-4315-842e-2b7121f7a4c4 type: regular task: id: 421c9a36-2621-4315-842e-2b7121f7a4c4 version: -1 name: Tag IP indicators description: commands.local.cmd.new.indicator script: Builtin|||createNewIndicator type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '8' scriptarguments: retry-count: simple: '3' retry-interval: simple: '2' tags: simple: CVE-2022-26134 type: simple: IP value: complex: root: ExtractedIndicators.IP filters: - - operator: isNotEmpty left: value: simple: ExtractedIndicators.IP iscontext: true transformers: - operator: uniq separatecontext: false continueonerror: true view: |- { "position": { "x": 450, "y": 1030 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '10': id: '10' taskid: e888e34b-9ee2-4dd2-8131-f9c3d66c3280 type: regular task: id: e888e34b-9ee2-4dd2-8131-f9c3d66c3280 version: -1 name: Tag CVE indicators description: commands.local.cmd.new.indicator script: Builtin|||createNewIndicator type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '8' scriptarguments: retry-count: simple: '3' retry-interval: simple: '2' tags: simple: CVE-2022-26134 type: simple: CVE value: complex: root: ExtractedIndicators.CVE filters: - - operator: isNotEmpty left: value: simple: ExtractedIndicators.CVE iscontext: true separatecontext: false continueonerror: true view: |- { "position": { "x": 870, "y": 1030 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '11': id: '11' taskid: 5f3c1e23-2ec6-4143-8b6a-cba9974d76d4 type: regular task: id: 5f3c1e23-2ec6-4143-8b6a-cba9974d76d4 version: -1 name: Download Yara Rules description: Download Yara rules provided by Volexity. scriptName: http type: regular iscommand: false brand: '' nexttasks: '#none#': - '5' scriptarguments: filename: simple: YaraRules.yar method: simple: GET saveAsFile: simple: yes url: simple: https://raw.githubusercontent.com/volexity/threat-intel/main/2022/2022-06-02%20Active%20Exploitation%20Of%20Confluence%200-day/indicators/yara.yar separatecontext: false view: |- { "position": { "x": -190, "y": 420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '12': id: '12' taskid: b2dd7e7e-351a-4173-801e-fdc5743a061d type: regular task: id: b2dd7e7e-351a-4173-801e-fdc5743a061d version: -1 name: Download Sigma Rules description: Download Sigma Rules scriptName: http type: regular iscommand: false brand: '' nexttasks: '#none#': - '5' scriptarguments: filename: simple: SigmaRules.yml method: simple: GET saveAsFile: simple: yes url: simple: https://raw.githubusercontent.com/SigmaHQ/sigma/master/rules/linux/process_creation/proc_creation_lnx_atlassian_confluence_cve_2022_26134.yml separatecontext: false view: |- { "position": { "x": 230, "y": 420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '13': id: '13' taskid: 0722e398-5141-4192-8119-aba606a4f9f5 type: title task: id: 0722e398-5141-4192-8119-aba606a4f9f5 version: -1 name: Collect Detection Rules type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '12' - '11' separatecontext: false view: |- { "position": { "x": 20, "y": 280 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '14': id: '14' taskid: b7930e4a-3684-43fc-8e03-4125157d5d57 type: regular task: id: b7930e4a-3684-43fc-8e03-4125157d5d57 version: -1 name: Collect indicators from Volexity description: This script will extract indicators from HTML and will handle bad TLD to avoid file extensions false positives. scriptName: ParseHTMLIndicators type: regular iscommand: false brand: '' nexttasks: '#none#': - '5' scriptarguments: unescape_domain: simple: 'False' url: simple: https://raw.githubusercontent.com/volexity/threat-intel/main/2022/2022-06-02%20Active%20Exploitation%20Of%20Confluence%200-day/indicators/indicators.csv separatecontext: false continueonerror: true view: |- { "position": { "x": 1090, "y": 420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false '15': id: '15' taskid: 2e674390-e3f8-4a0f-8aaf-6e0b1a748576 type: regular task: id: 2e674390-e3f8-4a0f-8aaf-6e0b1a748576 version: -1 name: Collect indicators from PicusSecurity description: This script will extract indicators from HTML and will handle bad TLD to avoid file extensions false positives. scriptName: ParseHTMLIndicators type: regular iscommand: false brand: '' nexttasks: '#none#': - '5' scriptarguments: unescape_domain: simple: 'False' url: simple: https://www.picussecurity.com/resource/cve-2022-26134-atlassian-confluence-zero-day-vulnerability-exploited separatecontext: false continueonerror: true view: |- { "position": { "x": 670, "y": 420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 2 isoversize: false isautoswitchedtoquietmode: false '16': id: '16' taskid: 1f273ca6-2fa5-405c-8ad6-d5fc85538607 type: regular task: id: 1f273ca6-2fa5-405c-8ad6-d5fc85538607 version: -1 name: Tag File indicators description: commands.local.cmd.new.indicator script: Builtin|||createNewIndicator type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '8' scriptarguments: retry-count: simple: '3' retry-interval: simple: '2' tags: simple: CVE-2022-26134 type: simple: IP value: complex: root: ExtractedIndicators.File filters: - - operator: isNotEmpty left: value: simple: ExtractedIndicators.File iscontext: true transformers: - operator: uniq separatecontext: false continueonerror: true view: |- { "position": { "x": 30, "y": 1030 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '17': id: '17' taskid: e97569d3-83e2-43ab-8ff1-707d7d668efa type: title task: id: e97569d3-83e2-43ab-8ff1-707d7d668efa version: -1 name: SIEM Advanced Hunting type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '18' - '19' - '26' separatecontext: false view: |- { "position": { "x": -350, "y": 1520 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '18': id: '18' taskid: 70c43d0b-f4d0-45a5-8a9a-06a59e350bbf type: condition task: id: 70c43d0b-f4d0-45a5-8a9a-06a59e350bbf version: -1 name: Is Splunk Enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: '' nexttasks: Yes: - '20' no: - '49' scriptarguments: brandname: simple: SplunkPy results: - brandInstances separatecontext: false view: |- { "position": { "x": -270, "y": 1660 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '19': id: '19' taskid: ca949be2-221b-4b76-8fb3-ad53bee2e9df type: condition task: id: ca949be2-221b-4b76-8fb3-ad53bee2e9df version: -1 name: Is QRadar Enabled? description: Check whether the values provided in arguments are equal. If either of the arguments are missing, no is returned. type: condition iscommand: false brand: '' nexttasks: '#default#': - '49' Yes: - '21' separatecontext: false conditions: - label: Yes condition: - - operator: isExists left: value: complex: root: modules filters: - - operator: containsGeneral left: value: simple: modules.brand iscontext: true right: value: simple: QRadar ignorecase: true - - operator: isEqualString left: value: simple: modules.state iscontext: true right: value: simple: active iscontext: true right: value: {} view: |- { "position": { "x": -750, "y": 1660 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '20': id: '20' taskid: 9cbf3947-0d51-478a-8ea1-f305188670c0 type: regular task: id: 9cbf3947-0d51-478a-8ea1-f305188670c0 version: -1 name: Splunk search for suspicious Java child process description: Searches Splunk for suspicious file creation where the file path is under INETCACHE. script: '|||splunk-search' type: regular iscommand: true brand: '' nexttasks: '#none#': - '30' scriptarguments: earliest_time: complex: root: inputs.SplunkEarliestTime latest_time: complex: root: inputs.SplunkLatestTime query: simple: (source="WinEventLog:*" AND (ParentImage="*\\java.exe") AND (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\AppVLP.exe" OR Image="*\\Cmstp.exe" OR Image="*\\Esentutl.exe" OR Image="*\\Eventvwr.exe" OR Image="*\\InfDefaultInstall.exe" OR Image="*\\Installutil.exe" OR Image="*\\Mavinject.exe" OR Image="*\\Microsoft.Workflow.Compiler.exe" OR Image="*\\Msbuild.exe" OR Image="*\\Msdt.exe" OR Image="*\\Odbcconf.exe" OR Image="*\\Presentationhost.exe" OR Image="*\\Regsvr32.exe" OR Image="*\\Rundll32.exe" OR Image="*\\SQLToolsPS.exe" OR Image="*\\Sqlps.exe" OR Image="*\\SyncAppvPublishingServer.exe" OR Image="*\\atbroker.exe" OR Image="*\\bash.exe" OR Image="*\\bginfo.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\cdb.exe" OR Image="*\\cmstp.exe" OR Image="*\\csi.exe" OR Image="*\\devtoolslauncher.exe" OR Image="*\\dnscmd.exe" OR Image="*\\dnx.exe" OR Image="*\\dxcap.exe" OR Image="*\\extexport.exe" OR Image="*\\forfiles.exe" OR Image="*\\ftp.exe" OR Image="*\\hh.exe" OR Image="*\\ieexec.exe" OR Image="*\\installutil.exe" OR Image="*\\jjs.exe" OR Image="*\\mavinject.exe" OR Image="*\\mftrace.exe" OR Image="*\\msbuild.exe" OR Image="*\\msdt.exe" OR Image="*\\mshta.exe" OR Image="*\\msiexec.exe" OR Image="*\\msxsl.exe" OR Image="*\\odbcconf.exe" OR Image="*\\pcalua.exe" OR Image="*\\presentationhost.exe" OR Image="*\\rcsi.exe" OR Image="*\\regasm.exe" OR Image="*\\regsvcs.exe" OR Image="*\\regsvr32.exe" OR Image="*\\rundll32.exe" OR Image="*\\runonce.exe" OR Image="*\\runscripthelper.exe" OR Image="*\\schtasks.exe" OR Image="*\\scriptrunner.exe" OR Image="*\\squirrel.exe" OR Image="*\\te.exe" OR Image="*\\tracker.exe" OR Image="*\\update.exe" OR Image="*\\verclsid.exe" OR Image="*\\vsjitdebugger.exe" OR Image="*\\wab.exe" OR Image="*\\wmic.exe" OR Image="*\\wsl.exe" OR Image="*\\xwizard.exe" OR Image="*\\explorer.exe")) separatecontext: false view: |- { "position": { "x": -530, "y": 1850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '21': id: '21' taskid: 3b33a04b-334b-42c2-87b4-22ed06788f72 type: playbook task: id: 3b33a04b-334b-42c2-87b4-22ed06788f72 version: -1 name: QRadar search for suspicious Java child process description: This playbook runs a QRadar query and return its results to the context. playbookName: QRadarFullSearch type: playbook iscommand: false brand: '' nexttasks: '#none#': - '31' scriptarguments: interval: simple: '1' query_expression: simple: SELECT UTF8(payload) from events where LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' and ("ParentImage" ilike '%\java.exe') and ("Image" ilike '%\cmd.exe' or "Image" ilike '%\powershell.exe' or "Image" ilike '%\AppVLP.exe' or "Image" ilike '%\Cmstp.exe' or "Image" ilike '%\Esentutl.exe' or "Image" ilike '%\Eventvwr.exe' or "Image" ilike '%\InfDefaultInstall.exe' or "Image" ilike '%\Installutil.exe' or "Image" ilike '%\Mavinject.exe' or "Image" ilike '%\Microsoft.Workflow.Compiler.exe' or "Image" ilike '%\Msbuild.exe' or "Image" ilike '%\Msdt.exe' or "Image" ilike '%\Odbcconf.exe' or "Image" ilike '%\Presentationhost.exe' or "Image" ilike '%\Regsvr32.exe' or "Image" ilike '%\Rundll32.exe' or "Image" ilike '%\SQLToolsPS.exe' or "Image" ilike '%\Sqlps.exe' or "Image" ilike '%\SyncAppvPublishingServer.exe' or "Image" ilike '%\atbroker.exe' or "Image" ilike '%\bash.exe' or "Image" ilike '%\bginfo.exe' or "Image" ilike '%\bitsadmin.exe' or "Image" ilike '%\cdb.exe' or "Image" ilike '%\cmstp.exe' or "Image" ilike '%\csi.exe' or "Image" ilike '%\devtoolslauncher.exe' or "Image" ilike '%\dnscmd.exe' or "Image" ilike '%\dnx.exe' or "Image" ilike '%\dxcap.exe' or "Image" ilike '%\extexport.exe' or "Image" ilike '%\forfiles.exe' or "Image" ilike '%\ftp.exe' or "Image" ilike '%\hh.exe' or "Image" ilike '%\ieexec.exe' or "Image" ilike '%\installutil.exe' or "Image" ilike '%\jjs.exe' or "Image" ilike '%\mavinject.exe' or "Image" ilike '%\mftrace.exe' or "Image" ilike '%\msbuild.exe' or "Image" ilike '%\msdt.exe' or "Image" ilike '%\mshta.exe' or "Image" ilike '%\msiexec.exe' or "Image" ilike '%\msxsl.exe' or "Image" ilike '%\odbcconf.exe' or "Image" ilike '%\pcalua.exe' or "Image" ilike '%\presentationhost.exe' or "Image" ilike '%\rcsi.exe' or "Image" ilike '%\regasm.exe' or "Image" ilike '%\regsvcs.exe' or "Image" ilike '%\regsvr32.exe' or "Image" ilike '%\rundll32.exe' or "Image" ilike '%\runonce.exe' or "Image" ilike '%\runscripthelper.exe' or "Image" ilike '%\schtasks.exe' or "Image" ilike '%\scriptrunner.exe' or "Image" ilike '%\squirrel.exe' or "Image" ilike '%\te.exe' or "Image" ilike '%\tracker.exe' or "Image" ilike '%\update.exe' or "Image" ilike '%\verclsid.exe' or "Image" ilike '%\vsjitdebugger.exe' or "Image" ilike '%\wab.exe' or "Image" ilike '%\wmic.exe' or "Image" ilike '%\wsl.exe' or "Image" ilike '%\xwizard.exe' or "Image" ilike '%\explorer.exe') timeout: simple: '600' separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 max: 0 view: |- { "position": { "x": -970, "y": 1850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '22': id: '22' taskid: e3cbb8d1-6a2a-4fb1-86eb-2bcb50d99cd5 type: regular task: id: e3cbb8d1-6a2a-4fb1-86eb-2bcb50d99cd5 version: -1 name: Elastic search for suspicious Java child process description: Searches an index. script: Elasticsearch v2|||search type: regular iscommand: true brand: Elasticsearch v2 nexttasks: '#none#': - '49' scriptarguments: index: complex: root: inputs.ElasticIndex query: simple: (process.parent.executable:*\\java.exe AND process.executable:(*\\cmd.exe OR *\\powershell.exe OR *\\AppVLP.exe OR *\\Cmstp.exe OR *\\Esentutl.exe OR *\\Eventvwr.exe OR *\\InfDefaultInstall.exe OR *\\Installutil.exe OR *\\Mavinject.exe OR *\\Microsoft.Workflow.Compiler.exe OR *\\Msbuild.exe OR *\\Msdt.exe OR *\\Odbcconf.exe OR *\\Presentationhost.exe OR *\\Regsvr32.exe OR *\\Rundll32.exe OR *\\SQLToolsPS.exe OR *\\Sqlps.exe OR *\\SyncAppvPublishingServer.exe OR *\\atbroker.exe OR *\\bash.exe OR *\\bginfo.exe OR *\\bitsadmin.exe OR *\\cdb.exe OR *\\cmstp.exe OR *\\csi.exe OR *\\devtoolslauncher.exe OR *\\dnscmd.exe OR *\\dnx.exe OR *\\dxcap.exe OR *\\extexport.exe OR *\\forfiles.exe OR *\\ftp.exe OR *\\hh.exe OR *\\ieexec.exe OR *\\installutil.exe OR *\\jjs.exe OR *\\mavinject.exe OR *\\mftrace.exe OR *\\msbuild.exe OR *\\msdt.exe OR *\\mshta.exe OR *\\msiexec.exe OR *\\msxsl.exe OR *\\odbcconf.exe OR *\\pcalua.exe OR *\\presentationhost.exe OR *\\rcsi.exe OR *\\regasm.exe OR *\\regsvcs.exe OR *\\regsvr32.exe OR *\\rundll32.exe OR *\\runonce.exe OR *\\runscripthelper.exe OR *\\schtasks.exe OR *\\scriptrunner.exe OR *\\squirrel.exe OR *\\te.exe OR *\\tracker.exe OR *\\update.exe OR *\\verclsid.exe OR *\\vsjitdebugger.exe OR *\\wab.exe OR *\\wmic.exe OR *\\wsl.exe OR *\\xwizard.exe OR *\\explorer.exe)) separatecontext: false view: |- { "position": { "x": -30, "y": 1850 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '26': id: '26' taskid: 77b21b3a-0624-4b06-8dfe-bf95dbb5b0ab type: condition task: id: 77b21b3a-0624-4b06-8dfe-bf95dbb5b0ab version: -1 name: Is Elastic Enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' scriptName: IsIntegrationAvailable type: condition iscommand: false brand: '' nexttasks: Yes: - '22' no: - '49' scriptarguments: brandname: simple: Elasticsearch v2 results: - brandInstances separatecontext: false view: |- { "position": { "x": 180, "y": 1660 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '30': id: '30' taskid: 3cd502d8-a86d-46be-82ef-45753ca48fa8 type: playbook task: id: 3cd502d8-a86d-46be-82ef-45753ca48fa8 version: -1 name: Splunk Indicator Hunting description: This playbook queries Splunk for indicators such as file hashes, IP addresses, domains, or urls. It outputs detected users, ip addresses, and hostnames related to the indicators. playbookName: Splunk Indicator Hunting type: playbook iscommand: false brand: '' nexttasks: '#none#': - '49' scriptarguments: IPAddress: complex: root: ExtractedIndicators accessor: IP transformers: - operator: uniq IndexName: complex: root: inputs.SplunkIndex MD5: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '32' transformers: - operator: uniq SHA1: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '40' transformers: - operator: uniq SHA256: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '64' SelectFields: simple: source,timestamp URLDomain: complex: root: ExtractedIndicators accessor: Domain transformers: - operator: uniq earliest_time: complex: root: inputs.SplunkEarliestTime event_limit: simple: '100' latest_time: complex: root: inputs.SplunkLatestTime separatecontext: true loop: iscommand: false scriptArguments: IPAddress: complex: root: ExtractedIndicators accessor: IP transformers: - operator: uniq IndexName: simple: index=* MD5: complex: root: ExtractedIndicators filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators iscontext: true right: value: simple: '32' accessor: File transformers: - operator: uniq SHA1: complex: root: ExtractedIndicators filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators iscontext: true right: value: simple: '40' accessor: File transformers: - operator: uniq SHA256: complex: root: ExtractedIndicators filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators iscontext: true right: value: simple: '64' accessor: File transformers: - operator: uniq SelectFields: simple: source,timestamp URLDomain: complex: root: ExtractedIndicators accessor: Domain transformers: - operator: uniq earliest_time: complex: root: inputs.SplunkEarliestTime event_limit: simple: '100' latest_time: complex: root: inputs.SplunkLatestTime exitCondition: '' wait: 1 max: 100 view: |- { "position": { "x": -530, "y": 2010 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '31': id: '31' taskid: 48c5b49f-675d-49c8-86a9-9384e10a8b52 type: playbook task: id: 48c5b49f-675d-49c8-86a9-9384e10a8b52 version: -1 name: QRadar Indicator Hunting V2 description: 'The Playbook queries QRadar SIEM for indicators such as file hashes, IP addresses, domains, or urls. ' playbookName: QRadar Indicator Hunting V2 type: playbook iscommand: false brand: '' nexttasks: '#none#': - '49' scriptarguments: IPAddress: complex: root: ExtractedIndicators accessor: IP transformers: - operator: uniq InvestigationIPFields: simple: sourceip,destinationip InvestigationUserFields: simple: username MD5: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '32' transformers: - operator: uniq QradarIPfield: simple: sourceip,destinationip SHA1: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '40' transformers: - operator: uniq SHA256: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '64' transformers: - operator: uniq TimeFrame: complex: root: inputs.QRadarTimeRange URLDomain: complex: root: ExtractedIndicators accessor: Domain transformers: - operator: uniq separatecontext: true loop: iscommand: false scriptArguments: IPAddress: complex: root: ExtractedIndicators accessor: IP transformers: - operator: uniq InvestigationIPFields: simple: sourceip,destinationip InvestigationUserFields: simple: username MD5: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '32' transformers: - operator: uniq QradarIPfield: simple: sourceip,destinationip SHA1: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '40' transformers: - operator: uniq SHA256: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '64' transformers: - operator: uniq TimeFrame: complex: root: inputs.QRadarTimeRange URLDomain: complex: root: ExtractedIndicators accessor: Domain transformers: - operator: uniq exitCondition: '' wait: 1 max: 100 view: |- { "position": { "x": -970, "y": 2010 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '36': id: '36' taskid: d695fbea-a43d-410b-8e56-bf8387ef84a5 type: title task: id: d695fbea-a43d-410b-8e56-bf8387ef84a5 version: -1 name: Threat Hunting type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '17' - '37' separatecontext: false view: |- { "position": { "x": 450, "y": 1360 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '37': id: '37' taskid: 14a03bb6-7718-4fc6-85fd-f863c2272fb0 type: title task: id: 14a03bb6-7718-4fc6-85fd-f863c2272fb0 version: -1 name: Palo Alto Networks Hunting type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '38' - '39' - '40' separatecontext: false view: |- { "position": { "x": 930, "y": 1520 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '38': id: '38' taskid: e376103e-a425-4fa3-82eb-1aef27dae03c type: playbook task: id: e376103e-a425-4fa3-82eb-1aef27dae03c version: -1 name: Palo Alto Networks - Hunting And Threat Detection description: "This is a multipurpose playbook used for hunting and threat detection. The playbook receives inputs based on hashes, IP addresses, or domain names provided manually or from outputs by other playbooks. \nWith the received indicators, the playbook leverages data received by PANW products including, Cortex Data Lake, Autofocus and Pan-OS to search for IP addresses, host names and users related to the provided indicators.\nThe output provided by the playbook facilitates pivoting searches for possibly affected IP addresses or users." playbookName: Palo Alto Networks - Hunting And Threat Detection type: playbook iscommand: false brand: '' nexttasks: '#none#': - '49' scriptarguments: IPAddresses: complex: root: ExtractedIndicators accessor: IP transformers: - operator: uniq MD5: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '32' transformers: - operator: uniq SHA1: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '40' transformers: - operator: uniq SHA256: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '64' transformers: - operator: uniq separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 max: 100 view: |- { "position": { "x": 720, "y": 1660 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '39': id: '39' taskid: 02910bf7-f940-4c08-8a9f-bb37242b4a4f type: playbook task: id: 02910bf7-f940-4c08-8a9f-bb37242b4a4f version: -1 name: Panorama Query Logs description: 'Query Panorama Logs of types: traffic, threat, url, data-filtering and wildfire.' playbookName: Panorama Query Logs type: playbook iscommand: false brand: '' nexttasks: '#none#': - '49' scriptarguments: log_type: simple: threat query: simple: threatid eq 92632 separatecontext: true loop: iscommand: false exitCondition: '' wait: 1 max: 100 view: |- { "position": { "x": 1140, "y": 1660 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '40': id: '40' taskid: d3f2eb48-ad3a-4bd6-8a4b-ffc9a6e3f4c4 type: title task: id: d3f2eb48-ad3a-4bd6-8a4b-ffc9a6e3f4c4 version: -1 name: Xpanse type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '41' separatecontext: false view: |- { "position": { "x": 1560, "y": 1660 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '41': id: '41' taskid: 60f71983-dbd4-4a32-8146-47049ba08e83 type: condition task: id: 60f71983-dbd4-4a32-8146-47049ba08e83 version: -1 name: Is Xpanse enabled? description: Checks if Xpanse instance is enabled. type: condition iscommand: false brand: '' nexttasks: '#default#': - '49' yes: - '42' separatecontext: false conditions: - label: yes condition: - - operator: isEqualString left: value: complex: root: modules filters: - - operator: containsString left: value: simple: modules.brand iscontext: true right: value: simple: Xpanse ignorecase: true accessor: state iscontext: true right: value: simple: active ignorecase: true view: |- { "position": { "x": 1560, "y": 1790 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '42': id: '42' taskid: d3eda59a-0ad8-40c6-82ff-6f59e9ae6553 type: regular task: id: d3eda59a-0ad8-40c6-82ff-6f59e9ae6553 version: -1 name: Search for possible vulnerable servers using Xpanse description: Retrieve issues script: '|||expanse-get-issues' type: regular iscommand: true brand: '' nexttasks: '#none#': - '48' scriptarguments: issue_type: simple: Atlassian Confluence Server, Insecure Atlassian Confluence Server, Atlassian Confluence Data Center, Insecure Atlassian Confluence Data Center separatecontext: false view: |- { "position": { "x": 1770, "y": 1960 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '43': id: '43' taskid: e80e21b2-dd4c-4e07-8777-f2d17099e7fd type: regular task: id: e80e21b2-dd4c-4e07-8777-f2d17099e7fd version: -1 name: 'Review possible vulnerable servers ' description: "Expander shows systems that are exposed to the public internet, without the need to install agents or sensors of any kind. Some of the systems below do not advertise version information, or are otherwise restricted from doing so depending on the configuration of our customers’ networks. Expander attempts to retrieve or derive version information, but this is not possible in all cases. \n\nXpanse issue IDs:\n${Expanse.Issue.id}" type: regular iscommand: false brand: '' nexttasks: '#none#': - '49' separatecontext: false view: |- { "position": { "x": 1920, "y": 2310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '48': id: '48' taskid: 55068046-21d5-423f-8158-b84b603fc3df type: condition task: id: 55068046-21d5-423f-8158-b84b603fc3df version: -1 name: Found servers using Xpanse? description: Checks if Xpanse found possible vulnerable server type: condition iscommand: false brand: '' nexttasks: '#default#': - '49' yes: - '43' separatecontext: false conditions: - label: yes condition: - - operator: isExists left: value: complex: root: Expanse.Issue accessor: id iscontext: true view: |- { "position": { "x": 1770, "y": 2120 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '49': id: '49' taskid: b0afb865-4516-4cf5-8c85-5cbe64996d14 type: title task: id: b0afb865-4516-4cf5-8c85-5cbe64996d14 version: -1 name: 'Remediation ' type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '51' separatecontext: false view: |- { "position": { "x": 450, "y": 2485 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '50': id: '50' taskid: d49d6248-82d5-47ec-8ed4-04ba8ee9bba3 type: playbook task: id: d49d6248-82d5-47ec-8ed4-04ba8ee9bba3 version: -1 name: Block Indicators - Generic v2 description: |+ This playbook blocks malicious indicators using all integrations that are enabled, using the following sub-playbooks: - Block URL - Generic - Block Account - Generic - Block IP - Generic v2 - Block File - Generic v2 - Block Email - Generic - Block Domain - Generic playbookName: Block Indicators - Generic v2 type: playbook iscommand: false brand: '' nexttasks: '#none#': - '54' scriptarguments: AutoCommit: simple: No CustomBlockRule: simple: 'True' CustomURLCategory: simple: Demisto Remediation - Malicious URLs IP: complex: root: ExtractedIndicators accessor: IP transformers: - operator: uniq MD5: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '32' transformers: - operator: uniq SHA256: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '64' transformers: - operator: uniq URL: complex: root: ExtractedIndicators accessor: URL transformers: - operator: uniq URLListName: simple: Demisto Remediation - URL EDL Username: complex: root: DBotScore filters: - - operator: isEqualString left: value: simple: DBotScore.Type iscontext: true right: value: simple: username ignorecase: true - - operator: greaterThanOrEqual left: value: simple: DBotScore.Score iscontext: true right: value: simple: '3' accessor: Indicator separatecontext: true loop: iscommand: false scriptArguments: AutoCommit: simple: No CustomBlockRule: simple: 'True' CustomURLCategory: simple: Demisto Remediation - Malicious URLs IP: complex: root: ExtractedIndicators accessor: IP transformers: - operator: uniq MD5: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '32' transformers: - operator: uniq SHA256: complex: root: ExtractedIndicators.File filters: - - operator: stringHasLength left: value: simple: ExtractedIndicators.File iscontext: true right: value: simple: '64' transformers: - operator: uniq URL: complex: root: ExtractedIndicators accessor: URL transformers: - operator: uniq URLListName: simple: Demisto Remediation - URL EDL exitCondition: '' wait: 1 max: 0 view: |- { "position": { "x": 450, "y": 2840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '51': id: '51' taskid: bf2d8054-37da-4e98-83e6-c6bb1f4f183f type: condition task: id: bf2d8054-37da-4e98-83e6-c6bb1f4f183f version: -1 name: Block indicators automatically? description: Checks whether IOCs associated with the incident can be blocked automatically. type: condition iscommand: false brand: '' nexttasks: '#default#': - '52' yes: - '53' - '50' separatecontext: false conditions: - label: yes condition: - - operator: isEqualString left: value: complex: root: inputs.BlockIndicatorsAutomatically iscontext: true right: value: simple: 'True' ignorecase: true view: |- { "position": { "x": 450, "y": 2620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '52': id: '52' taskid: 8c73e6da-4fcf-499e-8fba-111eed493d31 type: regular task: id: 8c73e6da-4fcf-499e-8fba-111eed493d31 version: -1 name: Block indicators manually description: Manually block the IOCs in the relevant systems. type: regular iscommand: false brand: '' nexttasks: '#none#': - '54' separatecontext: false view: |- { "position": { "x": 900, "y": 2840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '53': id: '53' taskid: 2b916599-d524-4b36-89d2-dab1785c0fc1 type: playbook task: id: 2b916599-d524-4b36-89d2-dab1785c0fc1 version: -1 name: PAN-OS - Block Domain - External Dynamic List description: |- This playbook blocks Domains using Palo Alto Networks Panorama or Firewall External Dynamic Lists. It checks if the EDL configuration is in place with the 'PAN-OS EDL Setup v3' sub-playbook (otherwise the list will be configured), and adds the input Domains to the relevant lists. playbookName: PAN-OS - Block Domain - External Dynamic List type: playbook iscommand: false brand: '' nexttasks: '#none#': - '54' scriptarguments: AutoCommit: simple: No Domain: complex: root: ExtractedIndicators accessor: Domain DomainListName: complex: root: inputs.EDLDomainBlocklist pre-post-rulebase: simple: pre-rulebase separatecontext: true loop: iscommand: false scriptArguments: AutoCommit: simple: No Domain: complex: root: ExtractedIndicators accessor: Domain DomainListName: complex: root: inputs.EDLDomainBlocklist pre-post-rulebase: simple: pre-rulebase exitCondition: '' wait: 1 max: 100 view: |- { "position": { "x": 0, "y": 2840 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '54': id: '54' taskid: ae346412-2fde-4ce3-8fcf-05256eadd3f9 type: title task: id: ae346412-2fde-4ce3-8fcf-05256eadd3f9 version: -1 name: Mitigation type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '57' - '59' - '60' separatecontext: false view: |- { "position": { "x": 450, "y": 3010 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '55': id: '55' taskid: 3d0e575d-b7c9-42b4-8b7b-2eabdfeea9df type: regular task: id: 3d0e575d-b7c9-42b4-8b7b-2eabdfeea9df version: -1 name: Install Confluence patched versions description: |- For **CVE-2022-26134**: [Confluence Server & Data Center Download Archives](https://www.atlassian.com/software/confluence/download-archives) type: regular iscommand: false brand: '' nexttasks: '#none#': - '71' separatecontext: false view: |- { "position": { "x": 450, "y": 3310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '56': id: '56' taskid: c6c530cc-cc34-4230-84b9-deb9571c7e7a type: regular task: id: c6c530cc-cc34-4230-84b9-deb9571c7e7a version: -1 name: Recommended workaround for Confluence 7.15.0-7.18.0 description: "**For Confluence 7.15.0 - 7.18.0**\n\nIf you run Confluence in a cluster, you will need to repeat this process on each node. You don't need to shut down the whole cluster to apply this mitigation. \n\n1. Shut down Confluence.\n\n2. Download the following 1 file to the Confluence server:\n\n[xwork-1.0.3-atlassian-10.jar](https://packages.atlassian.com/maven-internal/opensymphony/xwork/1.0.3-atlassian-10/xwork-1.0.3-atlassian-10.jar)\n\n3. **Delete** (or **move** the following JAR outside of the Confluence install directory):\n\n```\n/confluence/WEB-INF/lib/xwork-1.0.3-atlassian-8.jar\n ```\n**Do not leave a copy of this old JAR in the directory.** \n \n4. Copy the downloaded **xwork-1.0.3-atlassian-10.jar** into /confluence/WEB-INF/lib/\n \n\nCheck the permissions and ownership on the new **xwork-1.0.3-atlassian-10.jar** file that matches the existing files in the same directory.\n \n\nStart Confluence.\n\n**Remember**, If you run Confluence in a cluster, make sure you apply the above update on all of your nodes." type: regular iscommand: false brand: '' nexttasks: '#none#': - '71' separatecontext: false view: |- { "position": { "x": 910, "y": 3310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '57': id: '57' taskid: 76a4524a-76b4-45be-8104-558e84fadcbc type: title task: id: 76a4524a-76b4-45be-8104-558e84fadcbc version: -1 name: Atlassian suggested workarounds type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '56' - '66' separatecontext: false view: |- { "position": { "x": 1130, "y": 3160 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '59': id: '59' taskid: 33bde5e5-3105-4bf5-8e01-666547c050c7 type: title task: id: 33bde5e5-3105-4bf5-8e01-666547c050c7 version: -1 name: Patch Vulnerability type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '55' separatecontext: false view: |- { "position": { "x": 450, "y": 3160 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '60': id: '60' taskid: 3b6477a8-1f18-43e7-847d-23ecb509d0ca type: title task: id: 3b6477a8-1f18-43e7-847d-23ecb509d0ca version: -1 name: Deploy Detection Rules type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '63' - '64' separatecontext: false view: |- { "position": { "x": -230, "y": 3160 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '63': id: '63' taskid: 639f76af-6e9e-46f6-87ff-9ea304b96d50 type: regular task: id: 639f76af-6e9e-46f6-87ff-9ea304b96d50 version: -1 name: Sigma Rules description: Sigma rules file has been downloaded as SigmaRules.yml and is available for download directly from XSOAR. type: regular iscommand: false brand: '' nexttasks: '#none#': - '71' separatecontext: false view: |- { "position": { "x": -10, "y": 3310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '64': id: '64' taskid: 11344856-c4cd-4874-88d8-67c656b3e5ef type: regular task: id: 11344856-c4cd-4874-88d8-67c656b3e5ef version: -1 name: Yara Rules description: Yara rules file has been downloaded as YaraRules.yar and is available for download directly from XSOAR. type: regular iscommand: false brand: '' nexttasks: '#none#': - '71' separatecontext: false view: |- { "position": { "x": -450, "y": 3310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '66': id: '66' taskid: 253884de-3ce7-460c-83fe-4ac348a4b94d type: regular task: id: 253884de-3ce7-460c-83fe-4ac348a4b94d version: -1 name: Recommended workaround for Confluence 7.0.0-7.14.2 description: "**For Confluence 7.0.0 - Confluence 7.14.2**\n\nIf you run Confluence in a cluster, you will need to repeat this process on each node. You don't need to shut down the whole cluster to apply this mitigation. \n\n1. Shut down Confluence.\n\n2. Download the following 3 files to the Confluence server:\n\n[xwork-1.0.3-atlassian-10.jar](https://packages.atlassian.com/maven-internal/opensymphony/xwork/1.0.3-atlassian-10/xwork-1.0.3-atlassian-10.jar)\n[webwork-2.1.5-atlassian-4.jar](https://packages.atlassian.com/maven-internal/opensymphony/webwork/2.1.5-atlassian-4/webwork-2.1.5-atlassian-4.jar)\n[CachedConfigurationProvider.class](https://confluence.atlassian.com/doc/files/1130377146/1137639562/3/1654274890463/CachedConfigurationProvider.class)\n \n3. **Delete** (or **move** the following JARs outside of the Confluence install directory):\n ```\n/confluence/WEB-INF/lib/xwork-1.0.3.6.jar\n/confluence/WEB-INF/lib/webwork-2.1.5-atlassian-3.jar\n```\n**Do not leave a copy of the old JARs in the directory.**\n\n4. Copy the downloaded **xwork-1.0.3-atlassian-10.jar** into /confluence/WEB-INF/lib/\n \n5. Copy the downloaded **webwork-2.1.5-atlassian-4.jar** into /confluence/WEB-INF/lib/\n \n6. Check the permissions and ownership on **both new files** matches the existing files in the same directory.\n \n7. Change to directory /confluence/WEB-INF/classes/com/atlassian/confluence/setup\n \n a. Create a new directory called webwork\n\n b. Copy **CachedConfigurationProvider.class** into /confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork\n\n c. Ensure the permissions and ownership are correct for:\n```\n/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork\n```\n```\n/confluence/WEB-INF/classes/com/atlassian/confluence/setup/webwork/CachedConfigurationProvider.class\n```\n\n8. Start Confluence.\n\nRemember, If you run Confluence in a cluster, make sure you apply the above update on all of your nodes.\n\n\n\n**Note**: Confluence [End Of Life](https://confluence.atlassian.com/support/atlassian-support-end-of-life-policy-201851003.html) versions are not fully tested with the workaround.\n\nAtlassian **strongly recommends** upgrading to a fixed version of Confluence as there are several other security fixes included in the fixed versions of Confluence." type: regular iscommand: false brand: '' nexttasks: '#none#': - '71' separatecontext: false view: |- { "position": { "x": 1350, "y": 3310 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '67': id: '67' taskid: e9d2a7b8-b1cb-49db-8d2c-3c5539b4ad99 type: condition task: id: e9d2a7b8-b1cb-49db-8d2c-3c5539b4ad99 version: -1 name: Analysis resolution - Should continue with the investigation? description: Check with the analyst whether to continue with the investigation. type: condition iscommand: false brand: '' nexttasks: No: - '70' Yes: - '69' separatecontext: false view: |- { "position": { "x": 450, "y": 3620 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: simple: Do you need to continue with the investigation? methods: [] format: '' bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 completeafterv2: false completeaftersla: false replyOptions: - Yes - No skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '68': id: '68' taskid: 8ac5a3ac-8377-4e6d-82a5-85468db27990 type: title task: id: 8ac5a3ac-8377-4e6d-82a5-85468db27990 version: -1 name: Done type: title iscommand: false brand: '' description: '' separatecontext: false view: |- { "position": { "x": 450, "y": 4010 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '69': id: '69' taskid: a83f1355-465f-44f1-8d2f-1a99528a2b71 type: regular task: id: a83f1355-465f-44f1-8d2f-1a99528a2b71 version: -1 name: Investigate Further description: Manual step for further incident investigation. CISA released an open-source detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability. For more information , [CISA GitHub](https://github.com/cisagov/log4j-scanner/tree/master/log4-scanner) type: regular iscommand: false brand: '' nexttasks: '#none#': - '68' separatecontext: false view: |- { "position": { "x": 0, "y": 3830 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '70': id: '70' taskid: 2af15992-0a62-40d3-8b3e-6e6ddd5c5c16 type: regular task: id: 2af15992-0a62-40d3-8b3e-6e6ddd5c5c16 version: -1 name: Close Investigation description: Close the current incident script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - '68' scriptarguments: closeReason: simple: No further actions are required. separatecontext: false view: |- { "position": { "x": 450, "y": 3830 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false '71': id: '71' taskid: c6ba19c4-1faf-4b1b-8548-02bd7aad5a36 type: title task: id: c6ba19c4-1faf-4b1b-8548-02bd7aad5a36 version: -1 name: Resolution type: title iscommand: false brand: '' description: '' nexttasks: '#none#': - '67' separatecontext: false view: |- { "position": { "x": 450, "y": 3490 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": { "18_49_no": 0.28, "19_49_#default#": 0.21, "26_49_no": 0.41, "41_49_#default#": 0.11, "48_49_#default#": 0.13, "67_70_No": 0.63 }, "paper": { "dimensions": { "height": 3945, "width": 3270, "x": -970, "y": 130 } } } inputs: - key: SplunkEarliestTime value: simple: -7d@d required: false description: Splunk search earliest time. playbookInputQuery: - key: SplunkLatestTime value: simple: now required: false description: Splunk search latest time. playbookInputQuery: - key: SplunkIndex value: simple: '*' required: false description: |- The Splunk index field to search in. Default is "*" playbookInputQuery: - key: EDLDomainBlocklist value: {} required: false description: The EDL domain blocklist name. playbookInputQuery: - key: BlockIndicatorsAutomatically value: simple: "True" required: false description: Whether to block the indicators automatically or not. playbookInputQuery: - key: QRadarTimeRange value: simple: Last 7 DAYS required: false description: The time range for QRadar query. playbookInputQuery: - key: ElasticIndex value: {} required: false description: Elastic's index name in which to search. playbookInputQuery: outputs: [] quiet: true tests: - No tests (auto formatted) fromversion: 6.2.0 toversion: 6.4.9