Coverage › CVE-2023-43770
CVE-2023-43770 Mapped Sigma
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
- Vendor / product
- Roundcube — Webmail
- Description (CISA)
- Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.
- Added to KEV
- 2024-02-12
- Due date
- 2024-03-04
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Known ransomware use
- Unknown
- CWE
- CWE-79
- CISA notes
- https://roundcube.net/news/2023/09/15/security-update-1.6.3-released
https://nvd.nist.gov/vuln/detail/CVE-2023-43770 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1189 Drive-by Compromise | exploitation technique | This vulnerability is exploited by an adversary via malicious links embedded in trustworthy websites to infiltrate victim systems. Successful exploitation grants the adversary the ability to execute arbitrary code on the impacted system.
The Russia-aligned hacking group TAG-70 has been attributed to exploiting this vulnerability. TAG-70 has used this vulnerability in an espionage campaign targeting European government and military agencies, as well as Iranian embassies in Russia, aiming to gather intelligence on European political and military activities. The campaign, active from early to mid-October 2023, is part of a broader pattern of Russian state-aligned cyber-espionage targeting email services. ref 1 · ref 2 |
live |
| T1059 Command and Scripting Interpreter | primary impact | This vulnerability is exploited by an adversary via malicious links embedded in trustworthy websites to infiltrate victim systems. Successful exploitation grants the adversary the ability to execute arbitrary code on the impacted system.
The Russia-aligned hacking group TAG-70 has been attributed to exploiting this vulnerability. TAG-70 has used this vulnerability in an espionage campaign targeting European government and military agencies, as well as Iranian embassies in Russia, aiming to gather intelligence on European political and military activities. The campaign, active from early to mid-October 2023, is part of a broader pattern of Russian state-aligned cyber-espionage targeting email services. ref 1 |
live |
| T1082 System Information Discovery | secondary impact | This vulnerability is exploited by an adversary via malicious links embedded in trustworthy websites to infiltrate victim systems. Successful exploitation grants the adversary the ability to execute arbitrary code on the impacted system.
The Russia-aligned hacking group TAG-70 has been attributed to exploiting this vulnerability. TAG-70 has used this vulnerability in an espionage campaign targeting European government and military agencies, as well as Iranian embassies in Russia, aiming to gather intelligence on European political and military activities. The campaign, active from early to mid-October 2023, is part of a broader pattern of Russian state-aligned cyber-espionage targeting email services. ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1059 Command and Scripting Interpreter primary impact
- DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
AN1428 WindowsDetects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.Tunable:
CommandLinePatternParentProcessNameTimeWindowAN1429 LinuxDetects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.Tunable:InterpreterNameUserContextExecutionChainLengthAN1430 macOSDetects launch of command-line interpreters via Terminal, Automator, or hiddenosascript, especially when parent process lineage deviates from user-initiated applications.macos:unifiedloglog stream --info --predicate 'eventMessage CONTAINS "exec"'→ DC0032 Process CreationTunable:LaunchAgentNameScriptNameTerminalAppUsageAN1431 ESXiDetects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.Tunable:ShellEnabledFlagSSHContextAN1432 Network DevicesIdentifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) viaenablemode or scripting-capable sessions used by uncommon accounts or from unknown IPs.Tunable:UserRoleDeviceType
Sigma rules tagged attack.t1059 (95)
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
Detects usage of winget to add new additional download sources
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Author: Josh Nickels, Marius Rothenbücher
· 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Author: Florian Roth (Nextron Systems)
· 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43
Detects Windows shells and scripting applications that write files to suspicious folders
Author: frack113, Tim Shelton (update fp)
· 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe.
This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs
process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other
processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
All 95 rules on the technique page →
T1082 System Information Discovery secondary impact
- DET0525 System Discovery via Native and Remote Utilities
AN1452 WindowsDetection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.Tunable:
TimeWindowUserContextAN1453 LinuxExecution of system enumeration commands such asuname,df,uptime,hostname,lscpu, andcat /etc/os-releasethrough local terminal or scripts.Tunable:CommandListTerminalSessionIDAN1454 macOSExecution of system info utilities likesystemsetup,sw_vers,uname, orsysctlby terminal or scripted processes.Tunable:ParentProcessFrequencyThresholdAN1455 ESXiExecution ofesxcli system hostname get,esxcli system version get, oresxcli hardwarecommands through SSH or local shell.Tunable:SessionOriginCommandStringAN1456 IaaSUse of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.Tunable:IAMRoleContextAPIFrequencyAN1457 Network DevicesExecution ofshow version,show hardware, orshow systemcommands through CLI via SSH or console.Tunable:UsernameCommandList
Sigma rules tagged attack.t1082 (33)
Author: lazarg
· 2025-06-12 (modified 2025-10-25) · logsource: product=windows category=process_creation · 0022869c-49f7-4ff2-ba03-85ac42ddac58
Detects attempts to query system information directly from the Windows Registry.
Author: frack113
· 2022-01-01 (modified 2022-07-14) · logsource: product=windows category=process_creation · 0ef56343-059e-4cb6-adc1-4c3c967c5e46
Detects usage of the "systeminfo" command to retrieve information
Author: Seth Hanford
· 2023-08-23 · logsource: product=linux category=process_creation · 11701de9-d5a5-44aa-8238-84252f131895
Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery
Author: Ömer Günal, oscd.community
· 2020-10-08 (modified 2022-11-26) · logsource: product=linux service=auditd · 1f358e2e-cb63-43c3-b575-dfb072a6814f
Detects system information discovery commands
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-12-20 (modified 2024-01-02) · logsource: product=macos category=process_creation · 2d5e7a8b-f484-4a24-945d-7f0efd52eab0
Detects the use of "ioreg" which will show I/O Kit registry information.
This process is used for system information discovery.
It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.
Author: Ömer Günal, oscd.community
· 2020-10-08 (modified 2021-09-14) · logsource: product=linux category=process_creation · 42df45e7-e6e9-43b5-8f26-bec5b39cc239
Detects system information discovery commands
Author: Seth Hanford
· 2023-08-23 (modified 2025-11-24) · logsource: product=linux category=process_creation · 43e26eb5-cd58-48d1-8ce9-a273f5d298d8
Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.
Author: Stephen Lincoln `@slincoln_aiq` (AttackIQ)
· 2024-01-02 · logsource: product=macos category=process_creation · 4809c683-059b-4935-879d-36835986f8cf
Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
Author: frack113
· 2022-01-22 (modified 2024-03-19) · logsource: product=windows category=process_creation · 4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
Detects the use of the redirection character ">" to redirect information on the command line.
This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · 5259cbf2-0a75-48bf-b57a-c54d6fabaef3
Detects user data export activity.
Author: Florian Roth (Nextron Systems)
· 2023-05-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · 5722dff1-4bdd-4949-86ab-fbaf707e767a
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2023-12-20 · logsource: product=macos category=process_creation · 5de06a6f-673a-4fc0-8d48-bcfe3837b033
Detects the use of "sw_vers" for system information discovery
Author: Pratinav Chandra
· 2024-05-27 · logsource: product=macos category=process_creation · 6ff08e55-ea53-4f27-94a1-eff92e6d9d5c
Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information.
This process is primarily used to detect and avoid virtualization and analysis environments.
Author: Florian Roth (Nextron Systems)
· 2021-12-28 · logsource: product=windows category=process_creation · 7124aebe-4cd7-4ccb-8df0-6d6b93c96795
Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1
Author: Seth Hanford
· 2023-08-23 · logsource: product=linux category=process_creation · 746c86fb-ccda-4816-8997-01386263acc4
Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem
All 33 rules on the technique page →
T1189 Drive-by Compromise exploitation technique
- DET0176 Drive-by Compromise — Behavior-based, Multi-platform Detection Strategy (T1189)
AN0498 WindowsCorrelated evidence of anomalous browser/network behavior (suspicious external resource fetches and script injection patterns) followed by atypical child processes, ephemeral execution contexts, memory modification or process injection, and unexpected file drops. Defender sees network requests to previously unseen/suspicious domains or resources + browser process spawning unusual children or loading unsigned modules + file writes or registry changes shortly after those requests.WinEventLog:Application
Browser or plugin/application logs showing script errors, plugin enumerations, or unusual extension load events→ DC0038 Application Log Contentetw:Microsoft-Windows-Kernel-ProcessMemory Modification / Unmapped module load or suspicious RWX allocations in the process space of a browser process→ DC0020 Process ModificationNSM:Flowhttp.request: HTTP requests and responses for specific script resources, unexpected content-types (application/octet-stream for script URLs), suspicious referrers, or obfuscated javascript resources→ DC0085 Network Traffic ContentTunable:TimeWindowKnownGoodDomainsListPayloadEntropyThresholdUserContextAN0499 LinuxCorrelated evidence of browser or webview fetches to uncommon domains or mutated JS resources (proxy/NGFW logs + Zeek/HTTP logs) followed by unexpected interpreters or script engines executing (python, ruby, sh) spawned from browser processes or user sessions, rapid on-disk staging in /tmp, and outbound connections that deviate from baseline. Defender sees: uncommon resource fetch → short-lived child process executions from user browser context → file writes in temp directories → anomalous outbound C2-like connections.auditd:SYSCALLexecve: execve calls where a browser/webview process is parent and child is interpreter (python, sh, ruby) or downloader (curl, wget)→ DC0032 Process Creationlinux:syslogApplication or browser logs (webview errors, plugin enumerations) indicating suspicious script evaluation or plugin loads→ DC0038 Application Log ContentNSM:Flowhttp::response: HTTP responses with suspicious content-type for scripts, long obfuscated javascript bodies, or redirects to exploit kit domains→ DC0085 Network Traffic Contentlinux:SysmonNew files in /tmp, /var/tmp, $HOME/.cache, executed within TimeWindow after browser HTTP fetch→ DC0039 File CreationNSM:ConnectionsOutbound connections from newly spawned child processes or from the browser to uncommon endpoints or on anomalous ports→ DC0082 Network Connection CreationTunable:TempPathPatternsUserShellWhitelistDomainRarityThresholdAN0500 macOSCorrelated evidence where Safari/Chrome/WebKit-based processes issue network requests for uncommon or obfuscated JS resources followed by spawning of script interpreters, launchd or ad-hoc binaries, unusual child processes, or dynamic library loads into browser processes. Defender sees: proxy/HTTP logs with suspicious resource content + unifiedlogs/ASL showing browser/plugin crashes or extension loads + process events indicating child process creation and file writes to /var/folders or /tmp shortly after the fetch.macos:unifiedlogLogs from unifiedlogging that show browser crashes, plugin enumerations, extension installs or errors around the same time as suspicious network fetches→ DC0038 Application Log Contentmacos:unifiedlogprocess_create: Process creation where parent is Safari/Google Chrome and child is script interpreter or signed-but-unusual helper binary→ DC0032 Process Creationmacos:unifiedlogNew files written to /var/folders, /tmp, ~/Library/Caches, or ~/Downloads by browser context or its children→ DC0039 File CreationNSM:FlowHTTP/HTTPS requests for script resources flagged by content inspection (excessive obfuscation, eval usage, unusual redirects)→ DC0085 Network Traffic Contentmacos:unifiedlogAnomalous dyld dynamic library loads or RWX memory mappings in browser process→ DC0020 Process ModificationTunable:SleepyUserThresholdExtensionInstallPolicyAN0501 Identity ProviderPost-compromise identity & session anomalies that follow a drive-by compromise: token reuse from new/unfamiliar IPs, anomalous sign-in patterns for previously inactive users, unexpected consent/grant events, or provisioning changes. Defender sees an endpoint/browser compromise (network + endpoint signals) followed by unusual IdP events: new refresh token issuance, consent/consent-grant events, odd MFA bypass patterns, or unusual OAuth client registrations.azure:signinlogsSignIn: Sign-ins flagged as atypical (new geographic region, unfamiliar device id) shortly after correlated endpoint/browser compromise times→ DC0002 User Account Authenticationm365:unifiedApplication Consent grants, new OAuth client registrations, or unusual admin-level activities executed by a user account shortly after suspected drive-by compromise→ DC0038 Application Log Contentsaas:authRefresh token issuance or refresh token usage from new IPs or user agents→ DC0013 User Account MetadataAWS:CloudTrailConsoleLogin: If IdP backed by cloud provider, Console login from new IP/agent after correlated endpoint compromise→ DC0067 Logon Session CreationTunable:IdpAlertWindowHighRiskCountryListDeviceTrustLevel
Sigma rules tagged attack.t1189 (3)
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Florian Roth (Nextron Systems)
· 2017-10-25 (modified 2022-08-08) · logsource: category=proxy · 4922a5dd-6743-4fc2-8e81-144374280997
Detects a flashplayer update from an unofficial location
Author: Saw Win Naung, Nasreddine Bencherchali
· 2021-08-15 (modified 2022-06-14) · logsource: category=webserver · 65354b83-a2ea-4ea6-8414-3ab38be0d409
Detects XSS attempts injected via GET requests in access logs