Coverage › CVE-2022-29303

CVE-2022-29303 Mapped Sigma

SolarView Compact Command Injection Vulnerability

Vendor / product

SolarView — Compact

Description (CISA)

SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server.

Added to KEV

2023-07-13

Due date

2023-08-03

Required action

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Known ransomware use

Unknown

CWE

CWE-78

CISA notes

https://jvn.jp/en/vu/JVNVU92327282/
https://nvd.nist.gov/vuln/detail/CVE-2022-29303

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059 Command and Scripting Interpreter primary impact

• DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
  AN1428 Windows

  Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: CommandLinePattern ParentProcessName TimeWindow
  AN1429 Linux

  Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: InterpreterName UserContext ExecutionChainLength
  AN1430 macOS

  Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

  macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

  Tunable: LaunchAgentName ScriptName TerminalAppUsage
  AN1431 ESXi

  Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

  esxi:vobd shell session start → DC0064 Command Execution

  Tunable: ShellEnabledFlag SSHContext
  AN1432 Network Devices

  Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

  networkdevice:cli shell command → DC0064 Command Execution

  networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

  Tunable: UserRole DeviceType

Sigma rules tagged attack.t1059 (95)

All 95 rules on the technique page →

T1496 Resource Hijacking secondary impact

• DET0267 Resource Hijacking Detection Strategy
  AN0741 Windows

  Persistent high CPU utilization combined with suspicious command-line execution (e.g., mining tools or obfuscated scripts) and outbound connections to mining/proxy networks.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Windows:perfmon High sustained CPU usage by a single process → DC0018 Host Status

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: TimeWindow DestinationIPList ExecutableNamePatterns
  AN0742 Linux

  Abnormal CPU/memory usage by unauthorized processes with outbound connections to known mining pools or using cron jobs/scripts to maintain persistence.

  auditd:SYSCALL execve → DC0032 Process Creation

  linux:procfs Sustained high /proc/[pid]/stat usage → DC0018 Host Status

  NSM:Flow Outbound traffic to mining pools or proxies → DC0078 Network Traffic Flow

  Tunable: ProcessPath CPUThreshold KnownMiningDomains
  AN0743 macOS

  Background launch agents/daemons with high CPU use and network access to external mining services.

  macos:unifiedlog launchctl activity and process creation → DC0032 Process Creation

  macos:unifiedlog Persistent outbound traffic to mining domains → DC0085 Network Traffic Content

  Tunable: launchdLabel TrafficVolumeThreshold
  AN0744 IaaS

  Sudden spikes in cloud VM CPU usage with outbound traffic to mining pools and unauthorized instance creation.

  AWS:CloudTrail RunInstances → DC0080 Instance Start

  AWS:CloudWatch Sustained EC2 CPU usage above normal baseline → DC0018 Host Status

  AWS:VPCFlowLogs Outbound flow logs to known mining pools → DC0078 Network Traffic Flow

  Tunable: CPUUtilizationThreshold UnusualRegionList
  AN0745 Containers

  High CPU usage by unauthorized containers running mining binaries or public proxy tools.

  containerd:events New container with suspicious image name or high resource usage → DC0032 Process Creation

  prometheus:metrics Container CPU/Memory usage exceeding threshold → DC0018 Host Status

  container:cni Outbound network traffic to mining proxies → DC0078 Network Traffic Flow

  Tunable: ImageName CPUQuotaThreshold
  AN0746 SaaS

  Abuse of cloud messaging platforms to send mass spam or consume quota-based resources.

  m365:unified SendMessage → DC0069 Cloud Service Modification

  saas:application High-volume API calls or traffic via messaging or webhook service → DC0038 Application Log Content

  Tunable: MessageRateThreshold APIKeyList

Sigma rules tagged attack.t1496 (13)

T1505 Server Software Component exploitation technique

• DET0547 Detection Strategy for T1505 - Server Software Component
  AN1507 Windows

  Installation of malicious IIS/Apache/SQL server modules that later execute command-line interpreters or establish outbound connections.

  WinEventLog:Security EventCode=4698 → DC0001 Scheduled Job Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Application Unusual DLL/plugin registration for IIS/SQL/Apache or unexpected error logs → DC0038 Application Log Content

  Tunable: TimeWindow ParentProcessName
  AN1508 Linux

  Abuse of extensible server modules (e.g., Apache, Nginx, Tomcat) to load rogue plugins that initiate bash, connect to C2, or spawn reverse shells.

  auditd:SYSCALL execve → DC0032 Process Creation

  linux:syslog Module registration or stacktrace logs indicating segmentation faults or unknown module errors → DC0038 Application Log Content

  NSM:Flow Outbound connections from web server binaries (apache2, nginx, php-fpm) to unknown external IPs → DC0078 Network Traffic Flow

  Tunable: ServerBinaryPath OutboundPortRange
  AN1509 macOS

  Malicious use of webserver plugins (e.g., for nginx, PHP, Node.js) that execute AppleScript or open network sockets.

  macos:unifiedlog Script interpreter invoked by nginx/apache worker process → DC0032 Process Creation

  macos:unifiedlog Web server process initiating outbound TCP connections not tied to normal server traffic → DC0085 Network Traffic Content

  Tunable: ParentBinaryPath
  AN1510 ESXi

  Use of ESXi web interface plugins or vSphere extensions to embed persistent malicious scripts or services.

  esxi:hostd New extension/module install with unknown vendor ID → DC0038 Application Log Content

  esxi:vmkernel Unexpected restarts of management agents or shell access → DC0064 Command Execution

  Tunable: PluginVendorName AccessVector

Sigma rules tagged attack.t1505 (1)