Coverage › CVE-2023-44221

CVE-2023-44221 Mapped Sigma

SonicWall SMA100 Appliances OS Command Injection Vulnerability

Vendor / product

SonicWall — SMA100 Appliances

Description (CISA)

SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user.

Added to KEV

2025-05-01

Due date

2025-05-22

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-78

CISA notes

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018
https://nvd.nist.gov/vuln/detail/CVE-2023-44221

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059.004 Unix Shell primary impact

• DET0384 Behavioral Detection of Unix Shell Execution
  AN1081 Linux

  Detects bash, sh, zsh, or BusyBox shell execution initiated via remote sessions, unauthorized users, or embedded within secondary script interpreters. Focus is on chained behavior: shell > suspicious commands > network discovery or persistence indicators.

  auditd:SYSCALL execve → DC0032 Process Creation

  linux:osquery socket_events → DC0078 Network Traffic Flow

  linux:syslog auth.log / secure.log → DC0067 Logon Session Creation

  Tunable: ExecutableName UserContext ParentProcess TimeWindow CommandLinePattern
  AN1082 macOS

  Identifies use of sh/bash/zsh in suspicious context, such as user scripts launched from non-standard apps (e.g., Preview.app), embedded in LaunchDaemons, or executed outside Terminal.app. Looks for misuse in Automator, LaunchAgents, or NSAppleScript-executed shell.

  macos:unifiedlog log stream --predicate 'eventMessage contains "exec"' → DC0032 Process Creation

  macos:osquery launchd + process_events → DC0064 Command Execution

  macos:syslog system.log, asl.log → DC0029 Script Execution

  Tunable: ScriptLocation ParentProcess UserRole
  AN1083 ESXi

  Detects BusyBox or Ash shell execution from unauthorized logins or remote connections. Focus is on rare shell invocations from DCUI, SSH sessions, or remote management paths. Also watches for payload droppers or persistence artifacts using shell.

  esxi:vmkernel DCUI shell start, BusyBox activity → DC0064 Command Execution

  esxi:auth Shell login or escalation → DC0067 Logon Session Creation

  Tunable: UserContext CommandPattern ShellPath
  AN1084 Network Devices

  Detects Unix shell usage on network appliances (e.g., routers, firewalls, embedded Linux) through rare console commands, CLI interfaces, or script injection via exposed APIs or SSH.

  networkdevice:syslog CLI Command Audit → DC0064 Command Execution

  NSM:Flow remote access → DC0082 Network Connection Creation

  Tunable: Interface CommandString

Sigma rules tagged attack.t1059.004 (18)

All 18 rules on the technique page →

T1068 Exploitation for Privilege Escalation exploitation technique

• DET0514 Detection Strategy for Exploitation for Privilege Escalation
  AN1419 Windows

  Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

  WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  Tunable: DriverNamePattern TimeWindow ParentProcessPath
  AN1420 Linux

  Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL ACCESS → DC0035 Process Access

  auditd:SYSCALL dmesg → DC0016 Module Load

  Tunable: SetUIDBinaryList TimeWindow EffectiveUIDThreshold
  AN1421 macOS

  Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

  macos:unifiedlog process:exec and kext load events → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD → DC0016 Module Load

  Tunable: EntitlementList TimeWindow
  AN1422 Containers

  Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

  auditd:SYSCALL capset or setns → DC0067 Logon Session Creation

  containerd:runtime e.g., containerd, Docker events → DC0091 Container Enumeration

  Tunable: NamespaceEscapePattern TimeWindow

Sigma rules tagged attack.t1068 (31)

All 31 rules on the technique page →

T1543 Create or Modify System Process secondary impact

• DET0571 Detection of System Process Creation or Modification Across Platforms
  AN1575 Windows

  Detects command-line or API-based creation/modification of Windows Services via sc.exe, powershell.exe, services.exe, or ChangeServiceConfig. Looks for creation/modification of autostart services via registry changes, file drops to System32\services, and anomalous parent-child process trees.

  WinEventLog:Security EventCode=4697 → DC0060 Service Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

  Tunable: ServiceNamePattern ParentProcessFilter RegistryPathList
  AN1576 Linux

  Detects creation or modification of systemd service units, addition of cron jobs that invoke binaries on boot, or suspicious writes to /etc/init.d/. Monitors chmod +x and systemctl execution paths, especially from non-root parent processes.

  auditd:SYSCALL write or rename to /etc/systemd/system or /etc/init.d → DC0061 File Modification

  auditd:SYSCALL execution of systemctl or service with enable/start/modify → DC0064 Command Execution

  Tunable: ServicePathRegex UserContextList CommandNameList
  AN1577 macOS

  Detects creation or modification of LaunchDaemon or LaunchAgent plist files under /Library/LaunchDaemons/, ~/Library/LaunchAgents/, or similar. Monitors execution of launchctl, property list edits, and file permission changes.

  macos:unifiedlog launchctl load/unload or plist file modification → DC0064 Command Execution

  fs:fsusage file write to launchd plist paths → DC0061 File Modification

  Tunable: PlistPathList PlistKeyMonitor UnsignedBinaryAlert
  AN1578 Containers

  Detects creation of new container system processes via docker run --restart, kubectl exec to init containers, or modification of container init specs. Flags container images that override entrypoints to embed persistence behaviors.

  docker:events docker run with restart=always or modifying init → DC0072 Container Creation

  auditd:SYSCALL modification of entrypoint scripts or init containers → DC0061 File Modification

  Tunable: EntrypointOverridePattern RestartPolicyMatch KubeInitModPath

Sigma rules tagged attack.t1543 (9)

T1548 Abuse Elevation Control Mechanism exploitation technique

• DET0345 Detection Strategy for Abuse Elevation Control Mechanism (T1548)
  AN0975 Windows

  Correlate registry modifications (e.g., UAC bypass registry keys), unusual parent-child process relationships (e.g., control.exe spawning cmd.exe), and unsigned elevated process executions with non-standard tokens or elevation flags.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

  Tunable: ElevatedProcessPath ParentProcessName TimeWindow
  AN0976 Linux

  Monitor audit logs for setuid/setgid bit changes, executions where UID ≠ EUID (indicative of sudo or privilege escalation), and high-integrity binaries launched by unprivileged users.

  auditd:SYSCALL setuid or setgid bit changes → DC0059 File Metadata

  auditd:SYSCALL execve with UID ≠ EUID → DC0034 Process Metadata

  auditd:SYSCALL sudo or pkexec invocation → DC0021 OS API Execution

  Tunable: WatchedDirectories UserContext TimeWindow
  AN0977 macOS

  Detect execution of /usr/libexec/security_authtrampoline or use of AuthorizationExecuteWithPrivileges API, and monitor process lineage for unusual launches of GUI apps with escalated privileges.

  macos:unifiedlog authorization execute privilege requests → DC0021 OS API Execution

  auditd:SYSCALL execve with escalated privileges → DC0034 Process Metadata

  fs:fsusage binary execution of security_authtrampoline → DC0032 Process Creation

  Tunable: WatchedBinaries ExecutionParent
  AN0978 Identity Provider

  Monitor for unexpected privilege elevation operations via SAML assertion manipulation, role injection, or changes to identity mappings that result in access escalation.

  azure:signinlogs unusual role assumption or elevation path → DC0010 User Account Modification

  Tunable: AuthorizedRoleMappings TimeWindow
  AN0979 IaaS

  Detect sudden privilege escalations such as IAM role changes, user-assigned privilege boundaries, or elevation via assumed roles beyond normal behavior.

  AWS:CloudTrail role privilege expansion detected → DC0010 User Account Modification

  AWS:CloudTrail cross-account or unexpected assume role → DC0034 Process Metadata

  Tunable: PermittedRoleTransitions CrossAccountBoundary

Sigma rules tagged attack.t1548 (24)

All 24 rules on the technique page →