Coverage › CVE-2020-8657
CVE-2020-8657 Mapped Sigma
EyesOfNetwork Use of Hard-Coded Credentials Vulnerability
- Vendor / product
- EyesOfNetwork — EyesOfNetwork
- Description (CISA)
- EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token.
- Added to KEV
- 2021-11-03
- Due date
- 2022-05-03
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Unknown
- CWE
- CWE-798
- CISA notes
- https://nvd.nist.gov/vuln/detail/CVE-2020-8657
- Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
1 mapping object across 1 technique. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1106 Native API | exploitation technique | CVE-2020-8657 identifies a security issue in EyesOfNetwork 5.3 that exposes a vulnerability in the API key implementation. ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1106 Native API exploitation technique
- DET0529 Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls
AN1465 WindowsUnusual or suspicious processes loading critical native API DLLs (e.g., ntdll.dll, kernel32.dll) followed by direct syscall behavior, memory manipulation, or hollowing.Tunable:
DllNameImageTargetProcessAN1466 LinuxUserland processes invoking syscall-heavy libraries (libc, glibc) followed by fork, mmap, or ptrace behavior commonly associated with code injection or memory manipulation.Tunable:SyscallTypeProcessNameMAPS PathAN1467 macOSExecution of processes that link to CoreServices or Foundation APIs followed by creation of memory regions, code execution, or abnormal library injection.Tunable:API Framework NameExecution Context
Sigma rules tagged attack.t1106 (14)
Author: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community
· 2020-10-06 (modified 2026-04-29) · logsource: product=windows category=ps_script · 03d83090-8cba-44a0-b02f-0b756a050306
Detects usage of WinAPI functions in PowerShell scripts.
It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls.
These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.
Author: Christian Burkard (Nextron Systems)
· 2021-08-04 (modified 2023-11-28) · logsource: product=windows category=process_access · 09706624-b7f6-455d-9d02-adee024cee1d
Detects a typical pattern of a CobaltStrike BOF which inject into other processes
Author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2023-07-21 · logsource: product=windows category=ps_script · 19d65a1c-8540-4140-8062-8eb00db0bba5
Detects calls to WinAPI libraries from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.
Author: Christian Burkard (Nextron Systems), Tim Shelton (FP)
· 2021-07-28 (modified 2023-12-13) · logsource: product=windows category=process_access · 3f3f3506-1895-401b-9cc3-e86b16e630d0
Detects potential calls to NtOpenProcess directly from NTDLL.
Author: Markus Neis
· 2017-11-06 (modified 2021-11-27) · logsource: product=windows category=pipe_created · 739915e4-1e70-4778-8b8a-17db02f66db1
Detects a named pipe used by Turla group samples
Author: Rafal Piasecki
· 2022-08-10 (modified 2026-03-30) · logsource: product=linux service=auditd · 808146b2-9332-4d78-9416-d7e47012d83d
detects BPFDoor .lock and .pid files access in temporary file storage facility
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Alexander Rausch
· 2020-06-24 (modified 2023-03-01) · logsource: product=windows category=process_creation · 95022b85-ff2a-49fa-939a-d7b8f56eeb9b
Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
Author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2023-07-21 · logsource: product=windows category=ps_script · 9f22ccd5-a435-453b-af96-bf99cbb594d4
Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.
Author: Bhabesh Raj (rule), @thefLinkk
· 2022-06-27 (modified 2023-11-28) · logsource: product=windows category=process_access · b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5
Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles
Author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2019-10-26 (modified 2024-04-22) · logsource: product=windows category=process_creation · b5c7395f-e501-4a08-94d4-57fe7a9da9d2
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-06 (modified 2025-03-06) · logsource: product=windows category=process_creation · ba3f5c1b-6272-4119-9dbd-0bc8d21c2702
Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-07-17 (modified 2023-02-21) · logsource: product=windows category=process_creation · e32f92d1-523e-49c3-9374-bdb13b46a3ba
Detects suspicious mshta process execution patterns