Coverage › CVE-2017-11292

CVE-2017-11292 Mapped Sigma

Adobe Flash Player Type Confusion Vulnerability

Vendor / product

Adobe — Flash Player

Description (CISA)

Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution.

Added to KEV

2022-03-03

Due date

2022-03-24

Required action

The impacted product is end-of-life and should be disconnected if still in use.

Known ransomware use

Unknown

CWE

CWE-843

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2017-11292

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1005 Data from Local System secondary impact

• DET0380 Detection of Local Data Collection Prior to Exfiltration
  AN1070 Windows

  Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: TargetFilePathRegex ParentProcessFilter
  AN1071 Linux

  Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.

  auditd:SYSCALL open → DC0055 File Access

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: TimeWindow ScriptToolName
  AN1072 macOS

  Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.

  macos:unifiedlog process:spawn → DC0032 Process Creation

  fs:fsusage read/write → DC0055 File Access

  Tunable: UserContext TargetVolume
  AN1073 Network Devices

  Collection of device configuration via CLI commands (e.g., show running-config, copy flash, more), often followed by TFTP/SCP transfers.

  networkdevice:cli command logging → DC0064 Command Execution

  Tunable: CommandScope AuthenticatedUserList
  AN1074 ESXi

  Adversaries accessing datastore or configuration files via vim-cmd, esxcli, or SCP to extract logs, VMs, or host configurations.

  esxis:vmkernel Datastore Access → DC0055 File Access

  esxi:hostd Command Execution → DC0064 Command Execution

  Tunable: AccessPathRegex InteractiveShellUsage

Sigma rules tagged attack.t1005 (14)

T1105 Ingress Tool Transfer primary impact

• DET0060 Detect Ingress Tool Transfers via Behavioral Chain
  AN0165 Windows

  Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: ParentProcessName DestinationIPCategory FilePathRegex
  AN0166 Linux

  Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.

  auditd:SYSCALL connect, execve, write → DC0064 Command Execution

  auditd:SYSCALL file creation/modification → DC0039 File Creation

  iptables:LOG TCP connections → DC0078 Network Traffic Flow

  Tunable: ToolName DownloadExtension
  AN0167 macOS

  Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation

  macos:unifiedlog file write/create → DC0039 File Creation

  macos:unifiedlog connection open → DC0082 Network Connection Creation

  Tunable: DirectoryTargeted ProcessPath
  AN0168 ESXi

  Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.

  esxi:hostd command execution → DC0064 Command Execution

  esxi:vmkernel file write → DC0039 File Creation

  Tunable: ToolName DatastorePath
  AN0169 Network Devices

  Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

  NSM:Flow connection metadata → DC0078 Network Traffic Flow

  snmp:syslog firmware write/log event → DC0039 File Creation

  Tunable: PayloadVolumeThreshold ProtocolUsed

Sigma rules tagged attack.t1105 (87)

All 87 rules on the technique page →

T1204.002 Malicious File exploitation technique

• DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
  AN0819 Windows

  User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

  Tunable: TimeWindow SuspiciousExtensions UserPaths ParentApps SignerAllowList
  AN0820 macOS

  User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.

  macos:unifiedlog process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder} → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions → DC0039 File Creation

  Tunable: TimeWindow QuarantineRequired ParentApps
  AN0821 Linux

  User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.

  auditd:SYSCALL open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions → DC0039 File Creation

  auditd:SYSCALL execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser → DC0032 Process Creation

  Tunable: TimeWindow DesktopParentMap

Sigma rules tagged attack.t1204.002 (39)

All 39 rules on the technique page →

T1566.001 Spearphishing Attachment exploitation technique

• DET0236 Detection Strategy for Spearphishing Attachment across OS Platforms
  AN0655 Windows

  Detection of spearphishing attachments by correlating suspicious email delivery with subsequent file creation and abnormal process execution (e.g., Office spawning PowerShell or CMD). Behavior chain includes inbound email metadata → attachment stored on disk → process execution → outbound network activity.

  m365:unified Send/Receive: Inbound emails with attachments from suspicious or spoofed senders → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: AttachmentExtensions SuspiciousParentChildPairs TimeWindow
  AN0656 Linux

  Phishing attachments executed on Linux systems are detected by linking email logs to file creation in mail directories and subsequent suspicious process execution. Look for unexpected binaries or scripts spawned from user mail directories and anomalous outbound network activity.

  Application:Mail Inbound email attachments logged from MTAs with suspicious metadata → DC0038 Application Log Content

  auditd:SYSCALL execve: Execution of files saved in mail or download directories → DC0032 Process Creation

  NSM:Flow Outbound traffic from suspicious new processes post-attachment execution → DC0078 Network Traffic Flow

  Tunable: AttachmentStoragePaths ScriptInterpreters
  AN0657 macOS

  Phishing attachment detection on macOS through correlation of Mail app logs, file creation in user directories, and abnormal process execution (e.g., Preview.app or Mail.app spawning Terminal or scripting binaries). Network traffic after attachment interaction is also monitored.

  macos:unifiedlog Inbound messages with attachments from suspicious domains → DC0038 Application Log Content

  macos:unifiedlog Execution of Terminal, osascript, or other interpreters originating from Mail or Preview → DC0032 Process Creation

  macos:unifiedlog Attachment files written to ~/Downloads or temporary folders → DC0039 File Creation

  Tunable: ExecutionDelayThreshold SuspiciousParentApps

Sigma rules tagged attack.t1566.001 (24)

All 24 rules on the technique page →