Coverage › CVE-2022-47966
CVE-2022-47966 Mapped Sigma
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
- Vendor / product
- Zoho — ManageEngine
- Description (CISA)
- Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
- Added to KEV
- 2023-01-23
- Due date
- 2023-02-13
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Known
- CWE
- none recorded by CISA
- CISA notes
- https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html
https://nvd.nist.gov/vuln/detail/CVE-2022-47966 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1190 Exploit Public-Facing Application | exploitation technique | CVE-2022-47966 is a remote code execution vulnerability that affects many ManageEngine products due to misconfiguration of security features. Adversaries can utilized this vulnerability to run arbitrary java. APTs have been observed exploiting this vulnerability to gain access, to public-facing applications, establish persistence, and move laterally.
They've also been observed to create local user accounts with administrative privileges, use valid but disabled user accounts, delete logs, establish command and control communications, ... **the list goes on and on due to fantastic, detailed reporting**
ref 1 · ref 2 · ref 3 |
live |
| T1068 Exploitation for Privilege Escalation | primary impact | CVE-2022-47966 is a remote code execution vulnerability that affects many ManageEngine products due to misconfiguration of security features. Adversaries can utilized this vulnerability to run arbitrary java. APTs have been observed exploiting this vulnerability to gain access, to public-facing applications, establish persistence, and move laterally.
They've also been observed to create local user accounts with administrative privileges, use valid but disabled user accounts, delete logs, establish command and control communications, ... **the list goes on and on due to fantastic, detailed reporting**
ref 1 · ref 2 · ref 3 |
live |
| T1136.001 Local Account | primary impact | CVE-2022-47966 is a remote code execution vulnerability that affects many ManageEngine products due to misconfiguration of security features. Adversaries can utilized this vulnerability to run arbitrary java. APTs have been observed exploiting this vulnerability to gain access, to public-facing applications, establish persistence, and move laterally.
They've also been observed to create local user accounts with administrative privileges, use valid but disabled user accounts, delete logs, establish command and control communications, ... **the list goes on and on due to fantastic, detailed reporting**
ref 1 · ref 2 · ref 3 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1068 Exploitation for Privilege Escalation primary impact
- DET0514 Detection Strategy for Exploitation for Privilege Escalation
AN1419 WindowsDetects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.Tunable:
DriverNamePatternTimeWindowParentProcessPathAN1420 LinuxDetects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.Tunable:SetUIDBinaryListTimeWindowEffectiveUIDThresholdAN1421 macOSDetects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.Tunable:EntitlementListTimeWindowAN1422 ContainersDetects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.Tunable:NamespaceEscapePatternTimeWindow
Sigma rules tagged attack.t1068 (31)
Author: Florian Roth (Nextron Systems)
· 2019-11-20 (modified 2024-12-01) · logsource: product=windows category=process_creation · 02e0b2ea-a597-428e-b04a-af6a1a403e5c
Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-18 (modified 2023-12-02) · logsource: product=windows category=driver_load · 05296024-fe8a-4baf-8f3d-9a5f5624ceb2
Detects loading of known malicious drivers via their hash.
Author: Florian Roth (Nextron Systems)
· 2021-10-09 (modified 2022-12-25) · logsource: product=linux service=auditd · 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed
Detects command line parameter very often used with coin miners
Author: Nisarg Suthar
· 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72
Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.
Author: Swachchhanda Shrawn Poudel (Nextron Systems)
· 2025-10-02 (modified 2026-03-31) · logsource: product=linux category=file_event · 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463.
This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations.
When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment,
potentially leading to arbitrary code execution and privilege escalation.
Author: @eyezuhk Isaac Fernandes
· 2025-02-19 · logsource: product=windows category=image_load · 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1
Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.
Author: Florian Roth (Nextron Systems)
· 2017-03-01 (modified 2025-03-17) · logsource: product=linux · 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781
Detects buffer overflow attempts in Unix system log files
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
· 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
· 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-06 · logsource: product=windows category=process_creation · 38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8
Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments.
Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-03 (modified 2023-12-02) · logsource: product=windows category=driver_load · 39b64854-5497-4b57-a448-40977b8c9679
Detects loading of known malicious drivers via the file name of the drivers.
Author: Florian Roth (Nextron Systems)
· 2021-11-22 (modified 2022-12-25) · logsource: product=windows category=file_event · 3be82d5d-09fe-4d6a-a275-0d40d234d324
Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file
Author: Gene Kazimiarovich
· 2026-04-30 · logsource: product=linux service=auditd · 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94
Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall.
AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431
to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD
splice path that corrupts the page cache of SUID binaries.
Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN
daemons using non-default kernel offload configurations.
Author: Gene Kazimiarovich
· 2026-05-09 · logsource: product=linux category=process_creation · 474b415a-d917-4f3b-8c62-9e1a0d5f7b48
Detects kernel auto-loading of the authencesn crypto module via modprobe
This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher
(e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the
crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation,
where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path,
corrupting the page cache of SUID binaries for local privilege escalation.
On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod)
with 'modprobe' appearing in the command line.
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
All 31 rules on the technique page →
T1136.001 Local Account primary impact
- DET0447 T1136.001 Detection Strategy - Local Account Creation Across Platforms
AN1235 WindowsAdversary uses built-in tools like 'net user /add', PowerShell, or WMI to create a local user. Sequence: Account creation event (4720) follows process creation of a suspicious executable (e.g., powershell.exe or net.exe).Tunable:
ParentProcessNameTimeWindowUserContextAN1236 LinuxLocal user accounts are created via binaries like 'useradd', 'adduser', or by editing passwd/shadow. Behavior chain includes execution of user management binaries or modification of user database files.Tunable:BinaryPathExecutionSourceAN1237 macOSAccount creation using 'dscl -create' or via GUI tools. Detection involves command execution and file changes to the local directory services database.Tunable:UsernamePatternSessionOriginAN1238 ESXiAccount created using esxcli commands. Sequence includes esxcli execution and successful modification to account DB.Tunable:CommandOriginAN1239 ContainersAccount created in a running container (e.g., via 'useradd' or by modifying /etc/passwd directly). Detectable via runtime telemetry (e.g., Falco or eBPF hooks).Tunable:ContainerContextNamespaceScopeAN1240 Network DevicesAccount created via CLI using 'username' command or REST API. Detectable through AAA logging or CLI history telemetry.Tunable:PrivilegeLevelRemoteSessionFlag
Sigma rules tagged attack.t1136.001 (18)
Author: Pawel Mazur
· 2022-12-21 (modified 2025-01-21) · logsource: product=linux · 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e
Detects the addition of a new user to a privileged group such as "root" or "sudo"
Author: James Pemberton / @4A616D6573
· 2019-10-31 (modified 2022-10-09) · logsource: product=windows service=security · 1bbf25b9-8038-4154-a50b-118f2a32be27
Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.
Author: @ROxPinTeddy
· 2020-04-11 (modified 2022-12-25) · logsource: product=windows category=ps_script · 243de76f-4725-4f2e-8225-a8a69b15ad61
Detects creation of a local user via PowerShell
Author: Christian Burkard (Nextron Systems)
· 2021-05-03 (modified 2025-10-31) · logsource: product=windows category=registry_event · 460479f3-80b7-42da-9c43-2cc1d54dbccd
Sysmon registry detection of a local hidden user account.
Author: Alejandro Ortuno, oscd.community
· 2020-10-06 (modified 2023-02-18) · logsource: product=macos category=process_creation · 51719bf5-e4fd-4e44-8ba8-b830e7ac0731
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Author: Patrick Bareiss
· 2019-04-18 (modified 2021-01-17) · logsource: product=windows service=security · 66b6be3d-55d0-4f47-9855-d69df21740ea
Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 6d844f0f-1c18-41af-8f19-33e7654edfc3
Find local accounts being created or modified as well as remote authentication configurations
Author: Florian Roth (Nextron Systems)
· 2021-07-14 (modified 2022-12-18) · logsource: product=windows category=process_creation · 75578840-9526-4b2a-9462-af469a45e767
Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322
Author: Marie Euler, Pawel Mazur
· 2020-05-18 (modified 2022-12-20) · logsource: product=linux service=auditd · 759d0d51-bc99-4b5e-9add-8f5b2c8e7512
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Author: Christian Burkard (Nextron Systems)
· 2021-05-03 (modified 2024-01-16) · logsource: product=windows service=security · 7b449a5e-1db5-4dd0-a2dc-4e3a67282538
Detects the creation of a local hidden user account which should not happen for event ID 4720.
Author: William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-08-13 · logsource: product=windows category=process_creation · 7c9fed65-039a-4055-8c23-fa763d94aff6
Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns
trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create
user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-07-12 (modified 2023-02-21) · logsource: product=windows category=process_creation · b9f0e6f5-09b4-4358-bae4-08408705bd5c
Detects creation of local users via the net.exe command with the option "never expire"
Author: X__Junior (Nextron Systems)
· 2023-08-27 (modified 2023-10-15) · logsource: product=windows category=process_creation · bf906d7b-7070-4642-8383-e404cf26eba5
Detects creation of local users via the net.exe command with the name of "DarkGate"
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2025-11-01 · logsource: product=fortigate service=event · cd0a4943-0edd-42cf-b50c-06f77a10d4c1
Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
Author: Endgame, JHasenbusch (adapted to Sigma for oscd.community)
· 2018-10-30 (modified 2023-02-21) · logsource: product=windows category=process_creation · cd219ff3-fa99-45d4-8380-a7d15116c6dc
Identifies the creation of local users via the net.exe command.
All 18 rules on the technique page →
T1190 Exploit Public-Facing Application exploitation technique
- DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
AN0219 WindowsAdversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.ApplicationLog:IIS
IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns)→ DC0038 Application Log ContentTunable:PublicVIPsSuspiciousPatternsErrorRateThresholdTimeWindowAllowedChildListAN0220 LinuxAdversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.ApplicationLog:WebServer/var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors→ DC0038 Application Log ContentNSM:FlowHTTP payloads with SQLi/LFI/JNDI/deserialization indicators→ DC0085 Network Traffic ContentTunable:WebProcListChildToolListBurstThresholdTimeWindowAN0221 macOSAdversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.macos:unifiedlogApp/web server logs ingested via unified logging or filebeat (nginx/apache/node).→ DC0038 Application Log ContentTunable:ServiceListTimeWindowAN0222 ContainersAdversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).ApplicationLog:IngressKubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes→ DC0038 Application Log Contentdocker:eventsDocker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container→ DC0032 Process CreationNSM:FlowRequests towards cloud metadata or command & control from pod IPs→ DC0085 Network Traffic ContentTunable:IngressNamespacesMetadataEndpointsTimeWindowAN0223 IaaSAdversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.ALB:HTTPLogsAWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts→ DC0085 Network Traffic ContentAWS:VPCFlowLogsVPC/NSG flow logs for pod/instance egress to Internet or metadata→ DC0078 Network Traffic FlowTunable:LBProjectsErrorBurstAN0224 ESXiAdversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.esxi:hostd/var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections→ DC0038 Application Log ContentNSM:FlowConnections to TCP 427 (SLP) or vCenter web services from untrusted sources→ DC0085 Network Traffic ContentTunable:MgmtCIDRTimeWindowAN0225 Network DevicesAdversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.networkdevice:controlplaneSyslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands→ DC0038 Application Log ContentTunable:MgmtPortsTrustedAdmins
Sigma rules tagged attack.t1190 (149)
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-30 · logsource: category=webserver · 043c1609-0e32-4462-a6f2-5a0c2da3fafe
Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin
Author: @gott_cyber
· 2022-12-11 (modified 2023-03-24) · logsource: category=webserver · 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3
Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.
Author: Florian Roth (Nextron Systems)
· 2020-07-10 (modified 2023-01-02) · logsource: category=webserver · 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7
Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195
Author: Thomas Patzke
· 2017-08-06 (modified 2020-09-01) · logsource: product=ruby_on_rails category=application · 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a
Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts
Author: Bhabesh Raj
· 2023-02-23 · logsource: category=webserver · 0e1ebc5a-15d0-4bf6-8199-b2535397433a
Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla
Author: Nisarg Suthar
· 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72
Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.
Author: Florian Roth (Nextron Systems)
· 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
Author: jamesc-grafana
· 2024-07-11 · logsource: product=aws service=cloudtrail · 14f3f1c8-02d5-43a2-a191-91ffb52d3015
Detects changes to the security group entries for RDS databases.
This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-20 · logsource: category=proxy · 15697955-6a29-47ca-92e9-0e05efae3260
Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.
Author: Bhabesh Raj
· 2021-01-25 (modified 2023-01-02) · logsource: category=webserver · 15c312b9-00d0-4feb-8870-7d940a4bdc5e
Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188
Author: Moti Harmats
· 2023-02-11 · logsource: product=velocity category=application · 16c86189-b556-4ee8-b4c7-7e350a195a4f
Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.
Author: Bhabesh Raj
· 2021-02-24 (modified 2023-01-02) · logsource: category=webserver · 179ed852-0f9b-4009-93a7-68475910fd86
Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-22 (modified 2023-01-02) · logsource: category=webserver · 181f49fa-0b21-4665-a98c-a57025ebb8c7
Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint
Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton
· 2022-07-19 (modified 2026-06-11) · logsource: category=webserver · 19aa4f58-94ca-45ff-bc34-92e533c0994a
Detects known suspicious (default) user-agents related to scanning/recon tools
Author: Thomas Patzke
· 2017-08-12 (modified 2020-09-01) · logsource: product=python category=application · 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9
Generic rule for SQL exceptions in Python according to PEP 249