Coverage › CVE-2023-47565

CVE-2023-47565 Mapped Sigma

QNAP VioStor NVR OS Command Injection Vulnerability

Vendor / product: QNAP — VioStor NVR
Description (CISA): QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.
Added to KEV: 2023-12-21
Due date: 2024-01-11
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Unknown
CWE: CWE-78
CISA notes: https://www.qnap.com/en/security-advisory/qsa-23-48
https://nvd.nist.gov/vuln/detail/CVE-2023-47565
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1203 Exploitation for Client Execution	exploitation technique	CVE-2023-47565 is an OS command injection vulnerability in QNAP VioStor network video recorder (NVR) devices. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices. ref 1 · ref 2 · ref 3	live
T1496 Resource Hijacking	primary impact	CVE-2023-47565 is an OS command injection vulnerability in QNAP VioStor network video recorder (NVR) devices. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices. ref 1 · ref 2 · ref 3	live
T1498 Network Denial of Service	secondary impact	CVE-2023-47565 is an OS command injection vulnerability in QNAP VioStor network video recorder (NVR) devices. This vulnerability has been publicly reported to be leveraged during the InfectedSlurs campaign to install a Mirai malware variant with the intention of creating a distributed denial-of-service (DDoS) botnet with these infected devices. ref 1 · ref 2 · ref 3	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1203 Exploitation for Client Execution exploitation technique

DET0287 Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps)
AN0797 Windows
Cause→effect chain: (1) A client app (browser, Office, PDF/Flash/reader) experiences a crash/abnormal exit or loads from an unusual location, then (2) drops or modifies a file in user-writable paths, and/or (3) spawns an unexpected child (e.g., powershell/cmd/mshta/rundll32/wscript/installer), and (4) establishes outbound C2-like connections shortly after. Correlate application logs, file writes, process lineage, and network egress within a short window.

WinEventLog:Application EventCode=1000 → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: TimeWindow HighRiskChildren UserPaths AllowedPlugins EgressAllowlist

AN0798 Linux
Cause→effect chain: (1) Browser/Office/reader process logs crash/segfault or abnormal sandbox message, (2) new executable/script/write occurs in $HOME (Downloads, ~/.cache, /tmp), (3) unexpected child like curl/wget/bash/python opens network connections soon after.

linux:syslog browser/office crash, segfault, abnormal termination → DC0038 Application Log Content
auditd:SYSCALL open → DC0055 File Access
auditd:SYSCALL creat → DC0039 File Creation
auditd:SYSCALL rename,chmod → DC0061 File Modification
auditd:SYSCALL execve → DC0032 Process Creation
NetFlow:Flow new outbound connections from exploited process tree → DC0078 Network Traffic Flow

Tunable: TimeWindow UserPaths HighRiskChildren PackageUpdaters

AN0799 macOS
Cause→effect chain: (1) App crash/abnormal termination in unified logs for Safari/Chrome/Office/Preview, (2) new files/scripts in ~/Library, ~/Downloads, /private/var/folders/*, (3) unexpected child (osascript, zsh, bash, curl) spawned by those apps, (4) new outbound connections.

macos:unifiedlog process crash, abort, code signing violations → DC0038 Application Log Content
fs:fsevents create/write/rename under user-writable paths → DC0061 File Modification
macos:osquery exec → DC0032 Process Creation
NSM:Connections new connections from exploited lineage → DC0078 Network Traffic Flow

Tunable: TimeWindow HighRiskChildren UserPaths QuarantineBypass

Sigma rules tagged `attack.t1203` (35)

Download From Suspicious TLD - Blacklist lowtest

Author: Florian Roth (Nextron Systems) · 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19

Detects download of certain file types from hosts in suspicious TLDs

Suspicious HWP Sub Processes hightest

Author: Florian Roth (Nextron Systems) · 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Techniques: T1566.001 T1203 T1059.003

Suspicious Browser Child Process - MacOS mediumtest

Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Techniques: T1189 T1203 T1059

Antivirus - APT Malware Signature criticalexperimental

Author: Arnim Rupp (Nextron Systems) · 2026-06-15 · logsource: category=antivirus · 101a1877-2cf4-474d-abfd-7f6ac4788d1a

Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Techniques: T1203 T1219.002

Potentially Suspicious Child Process Of WinRAR.EXE mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-08-31 · logsource: product=windows category=process_creation · 146aace8-9bd6-42ba-be7a-0070d8027b76

Detects potentially suspicious child processes of WinRAR.exe.

Techniques: T1203

OMIGOD SCX RunAsProvider ExecuteShellCommand hightest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Techniques: T1068 T1190 T1203

Antivirus - Exploitation Framework Signature criticalstable

Author: Florian Roth (Nextron Systems), Arnim Rupp · 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 238527ad-3c2c-4e4f-a1f6-92fd63adb864

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Techniques: T1203 T1219.002

Suspicious Invocation of Shell via Rsync highexperimental

Author: Florian Roth · 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594

Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

Techniques: T1059 T1203

CVE-2021-31979 CVE-2021-33771 Exploits criticaltest

Author: Sittikorn S, frack113 · 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Techniques: T1566 T1203

CVE tags: CVE-2021-33771CVE-2021-31979

Dfsvc.EXE Network Connection To Non-Local IPs mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-12 (modified 2024-03-12) · logsource: product=windows category=network_connection · 3c21219b-49b5-4268-bce6-c914ed50f09c

Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs

Techniques: T1203

Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-05-20 · logsource: category=webserver · 41956f7c-7a6b-46d6-b6bb-da6eb2e83fbe

Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.

Techniques: T1190 T1203

CVE tags: CVE-2025-4427CVE-2025-4428

Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process highexperimental

Author: Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-10-31 · logsource: product=windows category=process_creation · 43259cc4-1b80-4931-bd98-baea01afc196

Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.

Techniques: T1190 T1203

CVE tags: CVE-2025-59287

Audit CVE Event criticaltest

Author: Florian Roth (Nextron Systems), Zach Mathis · 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Techniques: T1203 T1068 T1211 T1212 T1210 T1499.004

Dfsvc.EXE Initiated Network Connection Over Uncommon Port hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-12 (modified 2024-01-31) · logsource: product=windows category=network_connection · 4c5fba4a-9ef6-4f16-823d-606246054741

Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.

Techniques: T1203

Shai-Hulud Malicious Bun Execution highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=windows category=process_creation · 5299fadf-f228-4526-8274-251db1960be9

Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.

Techniques: T1195.002 T1203

All 35 rules on the technique page →

T1496 Resource Hijacking primary impact

DET0267 Resource Hijacking Detection Strategy
AN0741 Windows
Persistent high CPU utilization combined with suspicious command-line execution (e.g., mining tools or obfuscated scripts) and outbound connections to mining/proxy networks.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
Windows:perfmon High sustained CPU usage by a single process → DC0018 Host Status
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: TimeWindow DestinationIPList ExecutableNamePatterns

AN0742 Linux
Abnormal CPU/memory usage by unauthorized processes with outbound connections to known mining pools or using cron jobs/scripts to maintain persistence.

auditd:SYSCALL execve → DC0032 Process Creation
linux:procfs Sustained high /proc/[pid]/stat usage → DC0018 Host Status
NSM:Flow Outbound traffic to mining pools or proxies → DC0078 Network Traffic Flow

Tunable: ProcessPath CPUThreshold KnownMiningDomains

AN0743 macOS
Background launch agents/daemons with high CPU use and network access to external mining services.

macos:unifiedlog launchctl activity and process creation → DC0032 Process Creation
macos:unifiedlog Persistent outbound traffic to mining domains → DC0085 Network Traffic Content

Tunable: launchdLabel TrafficVolumeThreshold

AN0744 IaaS
Sudden spikes in cloud VM CPU usage with outbound traffic to mining pools and unauthorized instance creation.

AWS:CloudTrail RunInstances → DC0080 Instance Start
AWS:CloudWatch Sustained EC2 CPU usage above normal baseline → DC0018 Host Status
AWS:VPCFlowLogs Outbound flow logs to known mining pools → DC0078 Network Traffic Flow

Tunable: CPUUtilizationThreshold UnusualRegionList

AN0745 Containers
High CPU usage by unauthorized containers running mining binaries or public proxy tools.

containerd:events New container with suspicious image name or high resource usage → DC0032 Process Creation
prometheus:metrics Container CPU/Memory usage exceeding threshold → DC0018 Host Status
container:cni Outbound network traffic to mining proxies → DC0078 Network Traffic Flow

Tunable: ImageName CPUQuotaThreshold

AN0746 SaaS
Abuse of cloud messaging platforms to send mass spam or consume quota-based resources.

m365:unified SendMessage → DC0069 Cloud Service Modification
saas:application High-volume API calls or traffic via messaging or webhook service → DC0038 Application Log Content

Tunable: MessageRateThreshold APIKeyList

Sigma rules tagged `attack.t1496` (13)

Azure Kubernetes Network Policy Change mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 08d6ac24-c927-4469-b3b7-2e422d6e3c43

Identifies when a Azure Kubernetes network policy is modified or deleted.

Techniques: T1485 T1496 T1489

Azure Kubernetes Service Account Modified or Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 12d027c3-b48c-4d9d-8bb6-a732200034b2

Identifies when a service account is modified or deleted.

Techniques: T1531 T1485 T1496 T1489

Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 25cb259b-bbdc-4b87-98b7-90d7c72f8743

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Techniques: T1485 T1496 T1489

Potential Crypto Mining Activity highstable

Author: Florian Roth (Nextron Systems) · 2021-10-26 (modified 2023-02-13) · logsource: product=windows category=process_creation · 66c3b204-9f88-4d0a-a7f7-8a57d521ca55

Detects command line parameters or strings often used by crypto miners

Techniques: T1496

Azure Kubernetes Secret or Config Object Access mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 7ee0b4aa-d8d4-4088-b661-20efdf41a04c

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Techniques: T1485 T1496 T1489

Azure Kubernetes Sensitive Role Access mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 818fee0c-e0ec-4e45-824e-83e4817b0887

Identifies when ClusterRoles/Roles are being modified or deleted.

Techniques: T1485 T1496 T1489

Linux Crypto Mining Indicators hightest

Author: Florian Roth (Nextron Systems) · 2021-10-26 (modified 2022-12-25) · logsource: product=linux category=process_creation · 9069ea3c-b213-4c52-be13-86506a227ab1

Detects command line parameters or strings often used by crypto miners

Techniques: T1496

Azure Container Registry Created or Deleted lowtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 93e0ef48-37c8-49ed-a02c-038aab23628e

Detects when a Container Registry is created or deleted.

Techniques: T1485 T1496 T1489

Azure Kubernetes Cluster Created or Deleted lowtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 9541f321-7cba-4b43-80fc-fbd1fb922808

Detects when a Azure Kubernetes Cluster is created or deleted.

Techniques: T1485 T1496 T1489

Linux Crypto Mining Pool Connections highstable

Author: Florian Roth (Nextron Systems) · 2021-10-26 · logsource: product=linux category=network_connection · a46c93b7-55ed-4d27-a41b-c259456c4746

Detects process connections to a Monero crypto mining pool

Techniques: T1496

Monero Crypto Coin Mining Pool Lookup highstable

Author: Florian Roth (Nextron Systems) · 2021-10-24 · logsource: category=dns · b593fd50-7335-4682-a36c-4edcb68e4641

Detects suspicious DNS queries to Monero mining pools

Techniques: T1496 T1567

Author: Saw Winn Naung, Azure-Sentinel, @neu5ron · 2021-08-19 (modified 2022-07-07) · logsource: product=zeek service=dns · bf74135c-18e8-4a72-a926-0e4f47888c19

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

Techniques: T1569.002 T1496

Network Communication With Crypto Mining Pool highstable

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-10-26 (modified 2026-07-24) · logsource: product=windows category=network_connection · fa5b1358-b040-4403-9868-15f7d9ab6329

Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.

Techniques: T1496

T1498 Network Denial of Service secondary impact

DET0518 Behavioral Detection of T1498 – Network Denial of Service Across Platforms
AN1434 Windows
Executable or script generating large outbound network traffic targeting remote hosts or known amplification ports

WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: ThresholdEventVolume DestinationDiversity

AN1435 Linux
Flooding tools like hping3 or nping sending large volumes of packets across multiple ports or IPs

auditd:SYSCALL Execution of network stress tools or anomalies in socket/syscall behavior → DC0032 Process Creation
NSM:Flow High volume flows with incomplete TCP sessions or single-packet bursts → DC0078 Network Traffic Flow

Tunable: PacketRateThreshold

Sigma rules tagged `attack.t1498` (3)

Deployment Deleted From Kubernetes Cluster lowtest

Author: Leo Tsaousis (@laripping) · 2024-03-26 · logsource: product=kubernetes category=application service=audit · 40967487-139b-4811-81d9-c9767a92aa5a

Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations.

Techniques: T1498

OpenCanary - NTP Monlist Request hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 7cded4b3-f09e-405a-b96f-24248433ba44

Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.

Techniques: T1498

Potential BlackByte Ransomware Activity hightest

Author: Florian Roth (Nextron Systems) · 2022-02-25 (modified 2023-02-08) · logsource: product=windows category=process_creation · 999e8307-a775-4d5f-addc-4855632335be

Detects command line patterns used by BlackByte ransomware in different operations

Techniques: T1485 T1498 T1059.001 T1140

CVE-2023-47565 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1203 Exploitation for Client Execution exploitation technique

Sigma rules tagged attack.t1203 (35)

T1496 Resource Hijacking primary impact

Sigma rules tagged attack.t1496 (13)

T1498 Network Denial of Service secondary impact

Sigma rules tagged attack.t1498 (3)

Sigma rules tagged `attack.t1203` (35)

Sigma rules tagged `attack.t1496` (13)

Sigma rules tagged `attack.t1498` (3)