Coverage › CVE-2023-20867

CVE-2023-20867 Mapped Sigma

VMware Tools Authentication Bypass Vulnerability

Vendor / product

VMware — Tools

Description (CISA)

VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.

Added to KEV

2023-06-23

Due date

2023-07-14

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

CWE-287

CISA notes

https://www.vmware.com/security/advisories/VMSA-2023-0013.html
https://nvd.nist.gov/vuln/detail/CVE-2023-20867

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059 Command and Scripting Interpreter primary impact

• DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
  AN1428 Windows

  Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: CommandLinePattern ParentProcessName TimeWindow
  AN1429 Linux

  Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: InterpreterName UserContext ExecutionChainLength
  AN1430 macOS

  Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

  macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

  Tunable: LaunchAgentName ScriptName TerminalAppUsage
  AN1431 ESXi

  Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

  esxi:vobd shell session start → DC0064 Command Execution

  Tunable: ShellEnabledFlag SSHContext
  AN1432 Network Devices

  Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

  networkdevice:cli shell command → DC0064 Command Execution

  networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

  Tunable: UserRole DeviceType

Sigma rules tagged attack.t1059 (95)

All 95 rules on the technique page →

T1078 Valid Accounts exploitation technique

• DET0560 Detection of Valid Account Abuse Across Platforms
  AN1543 Windows

  Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.

  WinEventLog:Security EventCode=4624 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: LogonType TimeWindow GeoIPMismatch
  AN1544 Linux

  Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Connections sshd or PAM logins → DC0002 User Account Authentication

  Tunable: UserContext HostDensityThreshold LoginMethod
  AN1545 macOS

  Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.

  macos:unifiedlog loginwindow, sshd → DC0088 Logon Session Metadata

  macos:unifiedlog exec logs → DC0032 Process Creation

  Tunable: LoginOrigin ProcessTreeDepth
  AN1546 Identity Provider

  Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.

  saas:okta Sign-in logs / audit events → DC0002 User Account Authentication

  Tunable: MFAFailureCount RiskScoreThreshold IPGeoVelocity
  AN1547 Containers

  Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.

  kubernetes:audit authentication.k8s.io → DC0002 User Account Authentication

  Tunable: ServiceAccountScope ClusterIPWhitelist

Sigma rules tagged attack.t1078 (56)

All 56 rules on the technique page →

T1105 Ingress Tool Transfer secondary impact

• DET0060 Detect Ingress Tool Transfers via Behavioral Chain
  AN0165 Windows

  Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: ParentProcessName DestinationIPCategory FilePathRegex
  AN0166 Linux

  Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.

  auditd:SYSCALL connect, execve, write → DC0064 Command Execution

  auditd:SYSCALL file creation/modification → DC0039 File Creation

  iptables:LOG TCP connections → DC0078 Network Traffic Flow

  Tunable: ToolName DownloadExtension
  AN0167 macOS

  Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation

  macos:unifiedlog file write/create → DC0039 File Creation

  macos:unifiedlog connection open → DC0082 Network Connection Creation

  Tunable: DirectoryTargeted ProcessPath
  AN0168 ESXi

  Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.

  esxi:hostd command execution → DC0064 Command Execution

  esxi:vmkernel file write → DC0039 File Creation

  Tunable: ToolName DatastorePath
  AN0169 Network Devices

  Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

  NSM:Flow connection metadata → DC0078 Network Traffic Flow

  snmp:syslog firmware write/log event → DC0039 File Creation

  Tunable: PayloadVolumeThreshold ProtocolUsed

Sigma rules tagged attack.t1105 (87)

All 87 rules on the technique page →