Coverage › CVE-2022-41082

CVE-2022-41082 Mapped Sigma

Microsoft Exchange Server Remote Code Execution Vulnerability

Vendor / product

Microsoft — Exchange Server

Description (CISA)

Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.

Added to KEV

2022-09-30

Due date

2022-10-21

Required action

Apply updates per vendor instructions.

Known ransomware use

Known

CWE

CWE-502

CISA notes

https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/
https://nvd.nist.gov/vuln/detail/CVE-2022-41082

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

7 mapping objects across 6 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059.001 PowerShell exploitation technique, primary impact

• DET0455 Abuse of PowerShell for Arbitrary Execution
  AN1252 Windows

  Detects behavioral chains where PowerShell is launched with encoded commands, unusual parent processes, or suspicious modules loaded, potentially followed by network connections or child process spawning. Supports detection of both direct (powershell.exe) and indirect (.NET automation) invocations.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

  WinEventLog:PowerShell EventCode=400, 403 → DC0034 Process Metadata

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  Tunable: CommandLinePattern ParentProcessName TimeWindow LoadedModuleList ScriptBlockLengthThreshold

Sigma rules tagged attack.t1059.001 (220)

All 220 rules on the technique page →

T1078 Valid Accounts exploitation technique

• DET0560 Detection of Valid Account Abuse Across Platforms
  AN1543 Windows

  Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.

  WinEventLog:Security EventCode=4624 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: LogonType TimeWindow GeoIPMismatch
  AN1544 Linux

  Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Connections sshd or PAM logins → DC0002 User Account Authentication

  Tunable: UserContext HostDensityThreshold LoginMethod
  AN1545 macOS

  Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.

  macos:unifiedlog loginwindow, sshd → DC0088 Logon Session Metadata

  macos:unifiedlog exec logs → DC0032 Process Creation

  Tunable: LoginOrigin ProcessTreeDepth
  AN1546 Identity Provider

  Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.

  saas:okta Sign-in logs / audit events → DC0002 User Account Authentication

  Tunable: MFAFailureCount RiskScoreThreshold IPGeoVelocity
  AN1547 Containers

  Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.

  kubernetes:audit authentication.k8s.io → DC0002 User Account Authentication

  Tunable: ServiceAccountScope ClusterIPWhitelist

Sigma rules tagged attack.t1078 (56)

All 56 rules on the technique page →

T1087 Account Discovery secondary impact

• DET0587 Enumeration of User or Account Information Across Platforms
  AN1612 Windows

  Detection of processes performing local or domain account enumeration by invoking account directory queries or security APIs followed by structured output of account lists. The defender observes command execution or API invocation patterns that retrieve account information and produce enumeration artifacts shortly afterward.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Security EventCode=4798, 4799 → DC0099 Group Enumeration

  Tunable: CommandLinePattern TimeWindow UserContext
  AN1613 Linux

  Enumeration of users and groups through suspicious shell commands or unauthorized access to /etc/passwd or /etc/shadow.

  auditd:SYSCALL PATH → DC0055 File Access

  linux:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: AccessedFile ParentProcessName
  AN1614 macOS

  Detection of account enumeration through directory service queries or system utilities accessing account metadata stores, followed by structured enumeration output.

  macos:unifiedlog process event → DC0032 Process Creation

  macos:unifiedlog DirectoryService queries retrieving account information → DC0013 User Account Metadata

  Tunable: CommandLine ExecutionContext
  AN1615 IaaS

  Detection of enumeration of identity entities through cloud provider APIs where principals retrieve account metadata such as IAM users or roles in rapid succession.

  AWS:CloudTrail DescribeUsers / ListUsers / GetUser → DC0083 Cloud Service Enumeration

  Tunable: API_Method CallerType
  AN1616 Identity Provider

  Detection of identity directory enumeration through API calls or administrative queries retrieving multiple account objects within a short interval.

  azure:signinlogs Graph API Query → DC0083 Cloud Service Enumeration

  saas:okta User Enumeration Events → DC0013 User Account Metadata

  Tunable: QueryType AppContext
  AN1617 ESXi

  Detection of enumeration activity when system processes query ESXi host account configuration or management APIs to retrieve user account listings.

  esxi:vpxd vCenter Management → DC0064 Command Execution

  Tunable: CommandPattern PrivilegedSession
  AN1618 SaaS

  Account enumeration via bulk access to user directory features or hidden APIs.

  gcp:audit Directory API Access → DC0013 User Account Metadata

  Tunable: EndpointURL UserAgent
  AN1619 Office Suite

  Account discovery via VBA macros, COM objects, or embedded scripting.

  m365:unified Scripted Activity → DC0029 Script Execution

  Tunable: MacroName ExecutionScope

Sigma rules tagged attack.t1087 (16)

All 16 rules on the technique page →

T1482 Domain Trust Discovery secondary impact

• DET0007 Detection of Domain Trust Discovery via API, Script, and CLI Enumeration
  AN0016 Windows

  Adversary uses nltest, PowerShell, or Win32/.NET API to enumerate domain trust relationships (via DSEnumerateDomainTrusts, GetAllTrustRelationships, or LDAP queries), followed by discovery or authentication staging.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:PowerShell Get-ADTrust|GetAllTrustRelationships → DC0064 Command Execution

  WinEventLog:Security EventCode=4662 → DC0071 Active Directory Object Access

  Tunable: ParentImage TimeWindow UserContext API_Name

Sigma rules tagged attack.t1482 (17)

All 17 rules on the technique page →

T1505.003 Web Shell secondary impact

• DET0394 Web Shell Detection via Server Behavior and File Execution Chains
  AN1108 Windows

  Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation

  NSM:Flow Inbound HTTP POST with suspicious payload size or user-agent → DC0085 Network Traffic Content

  Tunable: WebRootPath ParentProcess
  AN1109 Linux

  File creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx

  auditd:SYSCALL new file created in /var/www/html, /srv/http, or similar web root → DC0039 File Creation

  auditd:SYSCALL apache2 or nginx spawning sh, bash, or python interpreter → DC0032 Process Creation

  NSM:Flow POST requests to .php, .jsp, .aspx files with high entropy body → DC0085 Network Traffic Content

  Tunable: WebRootPath PayloadEntropyThreshold TimeWindow
  AN1110 macOS

  Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www

  macos:unifiedlog httpd spawning bash, zsh, python, or osascript → DC0032 Process Creation

  auditd:SYSCALL file write operations in /Library/WebServer/Documents → DC0061 File Modification

  Tunable: InterpreterName ExecutionParent

Sigma rules tagged attack.t1505.003 (35)

All 35 rules on the technique page →

T1567 Exfiltration Over Web Service secondary impact

• DET0548 Detection Strategy for Exfiltration Over Web Service
  AN1511 Windows

  Processes that normally do not initiate network communications suddenly making outbound HTTPS connections with high outbound-to-inbound data ratios. Defender view: correlation between process creation logs (e.g., Word, Excel, PowerShell) and subsequent anomalous network traffic volumes toward common web services (Dropbox, Google Drive, OneDrive).

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: MonitoredServices ExfilVolumeThreshold TimeWindow
  AN1512 Linux

  Processes (tar, curl, python scripts) accessing large file sets and initiating outbound HTTPS POST requests with payload sizes inconsistent with baseline activity. Defender perspective: detect abnormal sequence of file archival followed by encrypted uploads to external web services.

  auditd:EXECVE curl or wget with POST/PUT options → DC0064 Command Execution

  auditd:SYSCALL open/read of sensitive directories (/etc, /home/*) → DC0055 File Access

  NSM:Flow sustained outbound HTTPS sessions with high data volume → DC0078 Network Traffic Flow

  Tunable: MonitoredTools DataVolumeThreshold
  AN1513 macOS

  Office apps or scripts writing files followed by xattr manipulation (to evade quarantine) and subsequent HTTPS uploads. Defender perspective: anomalous file modification + outbound TLS traffic originating from non-networking apps (Word, Excel, Preview).

  macos:unifiedlog execution of Office binaries with network activity → DC0032 Process Creation

  macos:unifiedlog read/write of user documents prior to upload → DC0055 File Access

  macos:unifiedlog outbound TLS connections to cloud storage providers → DC0085 Network Traffic Content

  Tunable: WatchedApplications
  AN1514 SaaS

  Abnormal API calls from user accounts invoking file upload endpoints outside normal baselines (M365, Google Drive, Box). Defender perspective: monitor unified audit logs for elevated frequency of Upload, Create, or Copy operations from compromised accounts.

  m365:unified FileUploaded or FileCopied events → DC0038 Application Log Content

  saas:box API calls exceeding baseline thresholds → DC0085 Network Traffic Content

  Tunable: APICallThreshold UserBaselineProfiles
  AN1515 ESXi

  ESXi guest OS or management interface processes establishing unexpected external HTTPS connections. Defender perspective: monitor vmx or hostd processes making outbound web requests with significant data transfer.

  esxi:vmkernel network session initiation with external HTTPS services → DC0082 Network Connection Creation

  esxi:hostd file copy or datastore upload via HTTPS → DC0055 File Access

  Tunable: DatastoreTransferThreshold

Sigma rules tagged attack.t1567 (12)