Coverage › CVE-2023-20109

CVE-2023-20109 Mapped Sigma

Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability

Vendor / product

Cisco — IOS and IOS XE

Description (CISA)

Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash.

Added to KEV

2023-10-10

Due date

2023-10-31

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-787

CISA notes

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-getvpn-rce-g8qR68sx
https://nvd.nist.gov/vuln/detail/CVE-2023-20109

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059 Command and Scripting Interpreter primary impact

• DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
  AN1428 Windows

  Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: CommandLinePattern ParentProcessName TimeWindow
  AN1429 Linux

  Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: InterpreterName UserContext ExecutionChainLength
  AN1430 macOS

  Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

  macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

  Tunable: LaunchAgentName ScriptName TerminalAppUsage
  AN1431 ESXi

  Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

  esxi:vobd shell session start → DC0064 Command Execution

  Tunable: ShellEnabledFlag SSHContext
  AN1432 Network Devices

  Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

  networkdevice:cli shell command → DC0064 Command Execution

  networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

  Tunable: UserRole DeviceType

Sigma rules tagged attack.t1059 (95)

All 95 rules on the technique page →

T1078 Valid Accounts exploitation technique

• DET0560 Detection of Valid Account Abuse Across Platforms
  AN1543 Windows

  Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.

  WinEventLog:Security EventCode=4624 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: LogonType TimeWindow GeoIPMismatch
  AN1544 Linux

  Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Connections sshd or PAM logins → DC0002 User Account Authentication

  Tunable: UserContext HostDensityThreshold LoginMethod
  AN1545 macOS

  Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.

  macos:unifiedlog loginwindow, sshd → DC0088 Logon Session Metadata

  macos:unifiedlog exec logs → DC0032 Process Creation

  Tunable: LoginOrigin ProcessTreeDepth
  AN1546 Identity Provider

  Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.

  saas:okta Sign-in logs / audit events → DC0002 User Account Authentication

  Tunable: MFAFailureCount RiskScoreThreshold IPGeoVelocity
  AN1547 Containers

  Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.

  kubernetes:audit authentication.k8s.io → DC0002 User Account Authentication

  Tunable: ServiceAccountScope ClusterIPWhitelist

Sigma rules tagged attack.t1078 (56)

All 56 rules on the technique page →

T1499 Endpoint Denial of Service primary impact

• DET0208 Endpoint Resource Saturation and Crash Pattern Detection Across Platforms
  AN0584 Windows

  Excessive resource exhaustion or service crash induced by processes launched by users or scripts that rapidly consume CPU/memory or attempt malformed service interactions.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Application Service crash, unhandled exception, or application hang warnings for critical services (e.g., IIS, DNS, SQL Server) → DC0038 Application Log Content

  WinEventLog:System System shutdowns due to bugcheck (Event ID 1001) or watchdog timer expirations → DC0018 Host Status

  Tunable: TimeWindow ServiceTarget CPUThresholdPercent
  AN0585 Linux

  Malicious script or binary causes repeated kernel panics, OOM kills, or systemd service restarts targeting services like nginx, httpd, sshd.

  auditd:SYSCALL execve → DC0032 Process Creation

  linux:syslog Out of memory killer invoked or kernel panic entries → DC0018 Host Status

  journald:systemd Repeated service restart attempts or unit failures → DC0038 Application Log Content

  Tunable: ServiceName RestartThreshold OOMKillCount
  AN0586 macOS

  Adversary launches high-entropy process or malformed app bundle causing repeated application crashes and system slowdowns.

  macos:unifiedlog Repeated process crashes logged by CrashReporter or system instability logs in com.apple.console → DC0038 Application Log Content

  macos:unifiedlog Spike in CPU or memory use from non-user-initiated processes → DC0018 Host Status

  Tunable: CrashCountThreshold PayloadEntropyThreshold
  AN0587 IaaS

  Instance enters degraded/unhealthy state due to abnormal process load or memory exhaustion, often caused by automation or script-based attacks.

  AWS:CloudWatch StatusCheckFailed or StatusCheckFailed_System for burstable instances (t2/t3) → DC0018 Host Status

  AWS:CloudTrail StartInstances → DC0080 Instance Start

  VPCFlowLogs:All High volume internal traffic with low entropy indicating looped or malicious DoS script → DC0078 Network Traffic Flow

  Tunable: InstanceType FailureThreshold
  AN0588 Containers

  Container orchestrator logs show crashlooping pods, repeated resource exhaustion, or malicious binaries with infinite loops consuming systemd/cgroup limits.

  kubernetes:events CrashLoopBackOff, OOMKilled, container restart count exceeds threshold → DC0018 Host Status

  docker:events Container exited with non-zero code repeatedly in short period → DC0038 Application Log Content

  Tunable: RestartCountThreshold ContainerImageEntropy

Sigma rules tagged attack.t1499 (3)