Coverage › CVE-2020-8196

CVE-2020-8196 Mapped Sigma

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability

Vendor / product

Citrix — Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance

Description (CISA)

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.

Added to KEV

2021-11-03

Due date

2022-05-03

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

CWE-284

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2020-8196

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1005 Data from Local System secondary impact

• DET0380 Detection of Local Data Collection Prior to Exfiltration
  AN1070 Windows

  Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: TargetFilePathRegex ParentProcessFilter
  AN1071 Linux

  Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.

  auditd:SYSCALL open → DC0055 File Access

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: TimeWindow ScriptToolName
  AN1072 macOS

  Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.

  macos:unifiedlog process:spawn → DC0032 Process Creation

  fs:fsusage read/write → DC0055 File Access

  Tunable: UserContext TargetVolume
  AN1073 Network Devices

  Collection of device configuration via CLI commands (e.g., show running-config, copy flash, more), often followed by TFTP/SCP transfers.

  networkdevice:cli command logging → DC0064 Command Execution

  Tunable: CommandScope AuthenticatedUserList
  AN1074 ESXi

  Adversaries accessing datastore or configuration files via vim-cmd, esxcli, or SCP to extract logs, VMs, or host configurations.

  esxis:vmkernel Datastore Access → DC0055 File Access

  esxi:hostd Command Execution → DC0064 Command Execution

  Tunable: AccessPathRegex InteractiveShellUsage

Sigma rules tagged attack.t1005 (14)

T1056 Input Capture exploitation technique

• DET0102 Behavioral Detection of Input Capture Across Platforms
  AN0282 Windows

  Monitors for abnormal process behavior and API calls like SetWindowsHookEx, GetAsyncKeyState, or device input polling commonly used for keystroke logging.

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

  Tunable: TargetImage TimeWindow
  AN0283 Linux

  Detects use of tools/scripts accessing input devices like /dev/input/* or evdev via suspicious processes lacking GUI context.

  auditd:SYSCALL open, read → DC0055 File Access

  auditd:SYSCALL write → DC0061 File Modification

  auditd:SYSCALL ptrace, ioctl → DC0021 OS API Execution

  Tunable: ProcessName DevicePath
  AN0284 macOS

  Monitors for TCC-bypassing or unauthorized access to input services like IOHIDSystem or Quartz Event Services used in keylogging or screen monitoring.

  macos:unifiedlog subsystem=com.apple.TCC → DC0034 Process Metadata

  macos:osquery launchd or process_events → DC0032 Process Creation

  Tunable: Service ParentProcess
  AN0285 Network Devices

  Detects web-based credential phishing by analyzing traffic to suspicious URLs that mimic login portals and POST credential content.

  NSM:Flow http.log → DC0085 Network Traffic Content

  NSM:Firewall proxy or TLS inspection logs → DC0082 Network Connection Creation

  Tunable: UserAgent URL_Path

Sigma rules tagged attack.t1056 (2)

T1082 System Information Discovery primary impact

• DET0525 System Discovery via Native and Remote Utilities
  AN1452 Windows

  Detection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

  Tunable: TimeWindow UserContext
  AN1453 Linux

  Execution of system enumeration commands such as uname, df, uptime, hostname, lscpu, and cat /etc/os-release through local terminal or scripts.

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: CommandList TerminalSessionID
  AN1454 macOS

  Execution of system info utilities like systemsetup, sw_vers, uname, or sysctl by terminal or scripted processes.

  macos:unifiedlog log show --predicate 'process == <utility>' → DC0064 Command Execution

  Tunable: ParentProcess FrequencyThreshold
  AN1455 ESXi

  Execution of esxcli system hostname get, esxcli system version get, or esxcli hardware commands through SSH or local shell.

  esxi:vmkernel /var/log/vmkernel.log → DC0064 Command Execution

  Tunable: SessionOrigin CommandString
  AN1456 IaaS

  Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.

  AWS:CloudTrail DescribeInstances, GetConsoleOutput, DescribeImages → DC0075 Instance Enumeration

  Tunable: IAMRoleContext APIFrequency
  AN1457 Network Devices

  Execution of show version, show hardware, or show system commands through CLI via SSH or console.

  networkdevice:syslog Privilege-level command execution → DC0064 Command Execution

  Tunable: Username CommandList

Sigma rules tagged attack.t1082 (33)

All 33 rules on the technique page →