Coverage › CVE-2019-13608

CVE-2019-13608 Mapped Sigma

Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability

Vendor / product

Citrix — StoreFront Server

Description (CISA)

Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.

Added to KEV

2021-11-03

Due date

2022-05-03

Required action

Apply updates per vendor instructions.

Known ransomware use

Known

CWE

CWE-611

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2019-13608

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

5 mapping objects across 5 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1003 OS Credential Dumping secondary impact

• DET0234 Credential Dumping via Sensitive Memory and Registry Access Correlation
  AN0648 Windows

  Processes accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

  WinEventLog:Security EventCode=4662 → DC0071 Active Directory Object Access

  Tunable: AccessMask TimeWindow ParentProcessFilter
  AN0649 Linux

  Processes opening /proc//mem or /proc//maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.

  auditd:SYSCALL open → DC0055 File Access

  auditd:SYSCALL ptrace → DC0035 Process Access

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: TargetProcessName ToolProcessName
  AN0650 macOS

  Unsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.

  macos:unifiedlog Code Execution & Entitlement Access → DC0034 Process Metadata

  macos:keychain Access to Keychain DB or system.keychain → DC0055 File Access

  macos:osquery Invocation of osascript or dylib injection → DC0032 Process Creation

  Tunable: KeychainAccessPath SignedBinaryStatus

Sigma rules tagged attack.t1003 (37)

All 37 rules on the technique page →

T1005 Data from Local System secondary impact

• DET0380 Detection of Local Data Collection Prior to Exfiltration
  AN1070 Windows

  Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: TargetFilePathRegex ParentProcessFilter
  AN1071 Linux

  Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.

  auditd:SYSCALL open → DC0055 File Access

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: TimeWindow ScriptToolName
  AN1072 macOS

  Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.

  macos:unifiedlog process:spawn → DC0032 Process Creation

  fs:fsusage read/write → DC0055 File Access

  Tunable: UserContext TargetVolume
  AN1073 Network Devices

  Collection of device configuration via CLI commands (e.g., show running-config, copy flash, more), often followed by TFTP/SCP transfers.

  networkdevice:cli command logging → DC0064 Command Execution

  Tunable: CommandScope AuthenticatedUserList
  AN1074 ESXi

  Adversaries accessing datastore or configuration files via vim-cmd, esxcli, or SCP to extract logs, VMs, or host configurations.

  esxis:vmkernel Datastore Access → DC0055 File Access

  esxi:hostd Command Execution → DC0064 Command Execution

  Tunable: AccessPathRegex InteractiveShellUsage

Sigma rules tagged attack.t1005 (14)

T1046 Network Service Discovery secondary impact

• DET0376 Behavioral Detection Strategy for Network Service Discovery Across Platforms
  AN1057 Windows

  Detects processes performing network enumeration (e.g., port scans, service probing) by correlating process creation, socket connections, and sequential destination IP probing within a time window.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: ScanRateThreshold KnownScannerExeList TimeWindow
  AN1058 Linux

  Detects use of network scanning utilities or scripts performing rapid connections to multiple services or hosts using auditd and netflow/pcap telemetry.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow Outbound TCP SYN or UDP to multiple ports/hosts → DC0078 Network Traffic Flow

  Tunable: PortScanThreshold ToolPatternRegex ExpectedScanSources
  AN1059 macOS

  Detects Bonjour-based mDNS enumeration or use of system tools (e.g., dns-sd, nmap) to find active services via multicast probing or targeted scans.

  macos:unifiedlog dns-sd, mDNSResponder, socket activity → DC0085 Network Traffic Content

  macos:osquery process_events → DC0032 Process Creation

  Tunable: MDNSServiceQueryPatterns UserContext ScanToolList
  AN1060 Containers

  Detects lateral discovery or container breakout attempts using netcat, curl, or custom binaries probing other services within the same namespace or VPC subnet.

  ebpf:syscalls socket connect → DC0082 Network Connection Creation

  ebpf:syscalls execve → DC0032 Process Creation

  containerd:runtime container-level outbound traffic events → DC0078 Network Traffic Flow

  Tunable: ExecutablePath TimeWindow NetworkDestinationCount

Sigma rules tagged attack.t1046 (20)

All 20 rules on the technique page →

T1059 Command and Scripting Interpreter primary impact

• DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
  AN1428 Windows

  Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: CommandLinePattern ParentProcessName TimeWindow
  AN1429 Linux

  Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: InterpreterName UserContext ExecutionChainLength
  AN1430 macOS

  Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

  macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

  Tunable: LaunchAgentName ScriptName TerminalAppUsage
  AN1431 ESXi

  Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

  esxi:vobd shell session start → DC0064 Command Execution

  Tunable: ShellEnabledFlag SSHContext
  AN1432 Network Devices

  Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

  networkdevice:cli shell command → DC0064 Command Execution

  networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

  Tunable: UserRole DeviceType

Sigma rules tagged attack.t1059 (95)

All 95 rules on the technique page →

T1078 Valid Accounts secondary impact

• DET0560 Detection of Valid Account Abuse Across Platforms
  AN1543 Windows

  Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.

  WinEventLog:Security EventCode=4624 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: LogonType TimeWindow GeoIPMismatch
  AN1544 Linux

  Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Connections sshd or PAM logins → DC0002 User Account Authentication

  Tunable: UserContext HostDensityThreshold LoginMethod
  AN1545 macOS

  Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.

  macos:unifiedlog loginwindow, sshd → DC0088 Logon Session Metadata

  macos:unifiedlog exec logs → DC0032 Process Creation

  Tunable: LoginOrigin ProcessTreeDepth
  AN1546 Identity Provider

  Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.

  saas:okta Sign-in logs / audit events → DC0002 User Account Authentication

  Tunable: MFAFailureCount RiskScoreThreshold IPGeoVelocity
  AN1547 Containers

  Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.

  kubernetes:audit authentication.k8s.io → DC0002 User Account Authentication

  Tunable: ServiceAccountScope ClusterIPWhitelist

Sigma rules tagged attack.t1078 (56)

All 56 rules on the technique page →