Coverage › CVE-2010-2883

CVE-2010-2883 Mapped Sigma

Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability

Vendor / product

Adobe — Acrobat and Reader

Description (CISA)

Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).

Added to KEV

2022-06-08

Due date

2022-06-22

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

CWE-119

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2010-2883

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1027 Obfuscated Files or Information primary impact

• DET0378 Behavioral Detection of Obfuscated Files or Information
  AN1064 Windows

  Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g., .zip, .7z, .enc) and abnormal command-line syntax or PowerShell obfuscation.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: PayloadEntropyThreshold TimeWindow SuspiciousParentProcessList
  AN1065 Linux

  Detects use of gzip, base64, tar, or openssl in scripts or commands that encode/encrypt files after file staging or system enumeration.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL open, write → DC0061 File Modification

  linux:cli Shell history logs → DC0064 Command Execution

  Tunable: CommandRegex SensitivePathList
  AN1066 macOS

  Monitors use of archive or encryption tools (zip, openssl) tied to user-scripted activity or binaries writing encoded payloads under /Users or /Volumes.

  macos:unifiedlog log stream --predicate 'processImagePath contains "zip" OR "base64"' → DC0064 Command Execution

  macos:osquery file_events → DC0039 File Creation

  Tunable: FilenameExtensionList UserContext
  AN1067 Network Devices

  Identifies transfer of base64, uuencoded, or high-entropy files over HTTP, FTP, or custom protocols in lateral movement or exfiltration streams.

  networkdevice:IDS content inspection / PCAP / HTTP body → DC0085 Network Traffic Content

  Tunable: EntropyThreshold ProtocolScope
  AN1068 ESXi

  Detects encoded PowerCLI or Base64-encoded payloads staged via datastore uploads or shell access (e.g., ESXi Shell or backdoored VIBs).

  esxi:vmkernel Datastore modification events → DC0059 File Metadata

  esxi:hostd Remote access API calls and file uploads → DC0021 OS API Execution

  Tunable: StagingLocation EncodedLengthThreshold

Sigma rules tagged attack.t1027 (94)

All 94 rules on the technique page →

T1059 Command and Scripting Interpreter secondary impact

• DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
  AN1428 Windows

  Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: CommandLinePattern ParentProcessName TimeWindow
  AN1429 Linux

  Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: InterpreterName UserContext ExecutionChainLength
  AN1430 macOS

  Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

  macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

  Tunable: LaunchAgentName ScriptName TerminalAppUsage
  AN1431 ESXi

  Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

  esxi:vobd shell session start → DC0064 Command Execution

  Tunable: ShellEnabledFlag SSHContext
  AN1432 Network Devices

  Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

  networkdevice:cli shell command → DC0064 Command Execution

  networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

  Tunable: UserRole DeviceType

Sigma rules tagged attack.t1059 (95)

All 95 rules on the technique page →

T1204.002 Malicious File exploitation technique

• DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
  AN0819 Windows

  User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

  Tunable: TimeWindow SuspiciousExtensions UserPaths ParentApps SignerAllowList
  AN0820 macOS

  User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.

  macos:unifiedlog process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder} → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions → DC0039 File Creation

  Tunable: TimeWindow QuarantineRequired ParentApps
  AN0821 Linux

  User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.

  auditd:SYSCALL open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions → DC0039 File Creation

  auditd:SYSCALL execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser → DC0032 Process Creation

  Tunable: TimeWindow DesktopParentMap

Sigma rules tagged attack.t1204.002 (39)

All 39 rules on the technique page →