Coverage › CVE-2019-3396

CVE-2019-3396 Mapped Sigma

Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability

Vendor / product

Atlassian — Confluence Server and Data Server

Description (CISA)

Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.

Added to KEV

2021-11-03

Due date

2022-05-03

Required action

Apply updates per vendor instructions.

Known ransomware use

Known

CWE

CWE-22

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2019-3396

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1090 Proxy primary impact

• DET0445 Detection of Proxy Infrastructure Setup and Traffic Bridging
  AN1229 Windows

  Suspicious process spawning (e.g., rundll32, svchost, powershell, or netsh) followed by network connection creation to internal hosts or uncommon external endpoints on high or non-standard ports.

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  NSM:Connections Outbound Connection → DC0078 Network Traffic Flow

  Tunable: ParentProcessName DestinationPort TimeWindow
  AN1230 Linux

  User-space tools (e.g., socat, ncat, iptables, ssh) used in non-standard ways to establish reverse shells, port-forwarding, or inter-host connections. Often chained with uncommon outbound destinations or SSH tunnels.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow Connection Tracking → DC0078 Network Traffic Flow

  Tunable: CommandLinePattern OutboundPortRange ProcessUserContext
  AN1231 macOS

  AppleScript, LaunchAgents, or remote login services (ssh, networksetup) establishing proxy tunnels or dynamic port forwards to external IPs or alternate local hosts.

  macos:unifiedlog None → DC0032 Process Creation

  NSM:Firewall pf firewall logs → DC0078 Network Traffic Flow

  NSM:Flow connection attempts → DC0082 Network Connection Creation

  Tunable: TargetDomain AppleScriptUsage LaunchAgentSource
  AN1232 ESXi

  Direct use of nc, socat, or reverse tunnel scripts initiated by abnormal user contexts or unauthorized VIBs initiating connections from hypervisor to external systems.

  esxi:shell None → DC0064 Command Execution

  esxi:vmkernel None → DC0078 Network Traffic Flow

  NSM:Flow conn.log → DC0082 Network Connection Creation

  Tunable: CLICommand DestinationIP UserContext
  AN1233 Network Devices

  Dynamic or static port forwarding rules added to route traffic through an internal host, or configuration changes to proxy firewall rules not aligned with baselined policy.

  NSM:Firewall Policy Change / Rule Update → DC0051 Firewall Rule Modification

  NSM:Flow Flow Creation (NetFlow/sFlow) → DC0078 Network Traffic Flow

  networkdevice:cli Interface commands → DC0064 Command Execution

  Tunable: RuleType ChangeUser FlowVolumeDelta

Sigma rules tagged attack.t1090 (22)

All 22 rules on the technique page →

T1133 External Remote Services exploitation technique

• DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
  AN1004 Windows

  Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Application VPN, Citrix, or remote access gateway logs showing external IP addresses → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: BusinessHours KnownRemoteIPs FailedLogonThreshold GeoIPWhitelist TimeWindow
  AN1005 Linux

  Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).

  auditd:SYSCALL ssh logins or execve of remote commands → DC0088 Logon Session Metadata

  NSM:Connections Failed password or accepted password for SSH users → DC0038 Application Log Content

  NSM:Flow connection: Inbound connections to SSH or VPN ports → DC0082 Network Connection Creation

  Tunable: KnownSSHClients FailedLogonThreshold TimeWindow
  AN1006 macOS

  Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.

  macos:unifiedlog Remote login (ssh) or screen sharing authentication attempts → DC0088 Logon Session Metadata

  macos:unifiedlog Inbound connections to VNC/SSH ports → DC0082 Network Connection Creation

  PF:Logs External traffic to remote access services → DC0078 Network Traffic Flow

  Tunable: KnownVNCServers TimeWindow
  AN1007 Containers

  Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.

  ApplicationLog:API Docker/Kubernetes API access from external sources → DC0038 Application Log Content

  kubernetes:audit Unauthorized container creation or kubelet exec logs → DC0088 Logon Session Metadata

  NSM:Flow External access to container ports (2375, 6443) → DC0082 Network Connection Creation

  Tunable: AllowedCIDRs TimeWindow

Sigma rules tagged attack.t1133 (20)

All 20 rules on the technique page →

T1202 Indirect Command Execution secondary impact

• DET0200 Indirect Command Execution – Windows utility abuse behavior chain
  AN0576 Windows

  Cause→effect chain: (1) A user or service launches an indirection utility (e.g., forfiles.exe, pcalua.exe, wsl.exe, scriptrunner.exe, ssh.exe with -o ProxyCommand/LocalCommand). (2) That utility spawns a secondary program/command (PowerShell, cmd, msiexec, regsvr32, curl, arbitrary EXE) and/or opens outbound network connections. (3) Optional precursor modification of SSH config to persist LocalCommand/ProxyCommand. Correlate process creation, command/script content, file access to %USERPROFILE%\.ssh\config, and network connections from the utility or its child.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: TimeWindow AllowedUtilities HighRiskChildren UserContext DestCIDRs

Sigma rules tagged attack.t1202 (40)

All 40 rules on the technique page →