Coverage › CVE-2024-53704

CVE-2024-53704 Mapped Sigma

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

Vendor / product

SonicWall — SonicOS

Description (CISA)

SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.

Added to KEV

2025-02-18

Due date

2025-03-11

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Known

CWE

CWE-287

CISA notes

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003
https://nvd.nist.gov/vuln/detail/CVE-2024-53704

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

5 mapping objects across 5 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1021.001 Remote Desktop Protocol secondary impact

• DET0327 Multi-event Detection Strategy for RDP-Based Remote Logins and Post-Access Activity
  AN0931 Windows

  Remote Desktop (RDP) logon by a user followed by unusual process execution, file access, or lateral movement activity within a short timeframe.

  WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4778, EventCode=4779 → DC0088 Logon Session Metadata

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: TimeWindow UserContext ProcessList HostAccessPatterns

Sigma rules tagged attack.t1021.001 (16)

All 16 rules on the technique page →

T1078.004 Cloud Accounts primary impact

• DET0546 Detection of Abused or Compromised Cloud Accounts for Access and Persistence
  AN1503 Identity Provider

  Detects anomalous authentication activity such as sign-ins from impossible geolocations or legacy protocols from high-privileged accounts.

  azure:signinlogs Sign-in activity → DC0002 User Account Authentication

  saas:okta user.authentication.sso → DC0088 Logon Session Metadata

  Tunable: AnomalousLocationThreshold ProtocolType
  AN1504 IaaS

  Detects cloud account use for API calls that exceed normal scope, such as IAM changes or access to services never used before.

  AWS:CloudTrail ConsoleLogin, AssumeRole, ListAccessKeys, CreateUser → DC0002 User Account Authentication

  gcp:audit admin.googleapis.com → DC0067 Logon Session Creation

  Tunable: ServiceInteractionBaseline RoleSwitchRateThreshold
  AN1505 SaaS

  Detects unexpected access or usage of cloud productivity tools (e.g., downloading large numbers of files, creating external shares) by internal users.

  m365:unified FileAccessed, SharingSet → DC0088 Logon Session Metadata

  gcp:audit drive.activity → DC0002 User Account Authentication

  Tunable: FileDownloadThreshold SharingPolicyViolationThreshold
  AN1506 Office Suite

  Detects login and usage patterns deviating from typical Microsoft 365 or Google Workspace user profiles.

  m365:signinlogs UserLogin → DC0088 Logon Session Metadata

  gcp:audit login.event → DC0002 User Account Authentication

  Tunable: BusinessHours OfficeProductivityToolBaseline

Sigma rules tagged attack.t1078.004 (41)

All 41 rules on the technique page →

T1083 File and Directory Discovery primary impact

• DET0370 Recursive Enumeration of Files and Directories Across Privilege Contexts
  AN1040 Windows

  Execution of file enumeration commands (e.g., 'dir', 'tree') from non-standard processes or unusual user contexts, followed by recursive directory traversal or access to sensitive locations.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: CommandLineRegex UserContext TimeWindow
  AN1041 Linux

  Use of file enumeration commands (e.g., 'ls', 'find', 'locate') executed by suspicious users or scripts accessing broad file hierarchies or restricted directories.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:PATH PATH → DC0055 File Access

  Tunable: FilePathDepth UserContext
  AN1042 macOS

  Execution of file or directory discovery commands (e.g., 'ls', 'find') from terminal or script-based tooling, especially outside normal user workflows.

  macos:unifiedlog log collect --predicate → DC0032 Process Creation

  fs:fsusage Filesystem Call Monitoring → DC0055 File Access

  Tunable: PredicateScope TimeWindow
  AN1043 ESXi

  Execution of esxcli commands to enumerate datastore, configuration files, or directory structures by unauthorized or remote users.

  esxi:shell Shell Access/Command Execution → DC0064 Command Execution

  esxi:hostd vSphere File API Access → DC0055 File Access

  Tunable: CLICommandPattern AccessSource
  AN1044 Network Devices

  Execution of file discovery commands (e.g., 'dir', 'show flash', 'nvram:') from CLI interfaces, especially by unauthorized users or from abnormal source IPs.

  networkdevice:syslog CLI Command Logging → DC0064 Command Execution

  Tunable: CommandWhitelist SessionOrigin

Sigma rules tagged attack.t1083 (24)

All 24 rules on the technique page →

T1199 Trusted Relationship exploitation technique

• DET0488 Detect abuse of Trusted Relationships (third-party and delegated admin access)
  AN1344 Windows

  Behavioral chain: (1) a login from a third-party account or untrusted source network establishes an interactive/remote session; (2) the session acquires elevated privileges or accesses sensitive resources atypical for that account; (3) subsequent lateral movement or data access occurs from the same session/device. Correlate Windows logon events, token elevation/privileged use, and resource access with third-party context.

  WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4776, 4771, 4770 → DC0088 Logon Session Metadata

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0038 Application Log Content

  Tunable: ThirdPartyCIDRs ExpectedAdminHosts TimeWindow HighValueResources
  AN1345 Linux

  Behavioral chain: (1) sshd or federated SSO logins from third-party networks or identities; (2) rapid sudo/su privilege elevation; (3) access to sensitive paths or east-west SSH. Correlate auth logs, process execution, and network flows.

  auditd:SYSCALL execve,socket,connect,openat → DC0088 Logon Session Metadata

  linux:syslog Accepted publickey/password for * from * port * ssh2 → DC0067 Logon Session Creation

  NSM:Flow ssh connections originating from third-party CIDRs → DC0085 Network Traffic Content

  Tunable: ThirdPartyUsers AllowedJumpHosts MFAExpected
  AN1346 macOS

  Behavioral chain: (1) third-party interactive login or mobileconfig-based device enrollment; (2) privilege use or admin group change; (3) lateral movement mounts/ssh. Correlate unified logs and network telemetry.

  macos:unifiedlog loginwindow or sshd successful login events → DC0067 Logon Session Creation

  macos:unifiedlog Group membership change for admin or wheel → DC0088 Logon Session Metadata

  NSM:Flow ssh/smb connections to internal resources from third-party devices → DC0085 Network Traffic Content

  Tunable: ManagedDeviceList
  AN1347 Identity Provider

  Behavioral chain: (1) delegated admin or external identity establishes session (e.g., partner/reseller DAP, B2B guest, SAML/OAuth trust); (2) role elevation or app consent/permission grant; (3) downstream privileged actions in the tenant. Correlate IdP sign-in, admin/role assignment, and consent/admin-on-behalf events.

  azure:signinlogs InteractiveUser, ServicePrincipalSignIn → DC0067 Logon Session Creation

  azure:audit Add delegated admin / Assign admin roles / Update application consent → DC0088 Logon Session Metadata

  m365:unified Set-PartnerOfRecord / CompanyAdministrator role assignments / New-DelegatedAdminRelationship → DC0038 Application Log Content

  Tunable: TrustedPartnerTenantIDs RequiredMFA RoleScopeAllowList
  AN1348 IaaS

  Behavioral chain: (1) cross-account or third-party principal assumes a role into the tenant/subscription/project; (2) privileged API calls are made in short succession; (3) access originates from unfamiliar networks or geos. Correlate assume-role/federation events with sensitive API usage.

  AWS:CloudTrail AssumeRole,AssumeRoleWithSAML,AssumeRoleWithWebIdentity → DC0067 Logon Session Creation

  AWS:CloudTrail CreateUser|AttachRolePolicy|CreateAccessKey|UpdateAssumeRolePolicy|CreateLoginProfile → DC0038 Application Log Content

  gcp:audit google.iam.credentials.generateAccessToken / serviceAccountTokenCreator → DC0088 Logon Session Metadata

  Tunable: ExternalAccountAllowList SensitiveAPIs GeoVelocityThreshold
  AN1349 SaaS

  Behavioral chain: (1) third-party app or admin connects via OAuth/marketplace install; (2) high-privilege scopes granted; (3) anomalous actions (mass read/exports, admin changes).

  saas:googleworkspace OAuth2 authorization grants / Admin role assignments → DC0038 Application Log Content

  saas:salesforce ConnectedApp OAuth policy change / Login as user → DC0088 Logon Session Metadata

  Tunable: ApprovedApps ExportVolumeThreshold
  AN1350 Office Suite

  Behavioral chain: (1) delegated administration offers/relationships created or modified by partner tenants; (2) mailbox delegation/impersonation enabled; (3) follow-on access from partner IPs.

  m365:unified Add-DelegatedAdmin, Set-PartnerOfRecord, Add-MailboxPermission, Set-OrganizationRelationship → DC0038 Application Log Content

  azure:signinlogs InteractiveUser, NonInteractiveUser → DC0067 Logon Session Creation

  Tunable: MailboxDelegateAllowList

Sigma rules tagged attack.t1199 (2)

T1212 Exploitation for Credential Access exploitation technique

• DET0174 Detection Strategy for Exploitation for Credential Access
  AN0493 Windows

  Detects adversary exploitation of authentication mechanisms or credential validation processes. Defender perspective includes forged Kerberos tickets (e.g., MS14-068), abnormal LSASS memory access, replayed authentication attempts, and unexpected crashes of authentication services. Multi-event correlation ties exploitation attempts to abnormal process creation, service instability, and suspicious authentication events.

  WinEventLog:Security EventCode=4768, 4769, 4770 → DC0002 User Account Authentication

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  Tunable: MonitoredAccounts ReplayDetectionWindow
  AN0494 Linux

  Detects exploitation of authentication daemons or PAM modules. Defender perspective includes failed or anomalous PAM authentications, abnormal segfaults in authentication services, and exploitation attempts followed by successful unauthorized logins. Correlation identifies memory corruption, replay attempts, and privilege escalation tied to credential services.

  auditd:SYSCALL execve: Suspicious binaries or scripts interacting with authentication binaries (sshd, gdm, login) → DC0032 Process Creation

  NSM:Connections Repeated failed authentication attempts or replay patterns → DC0002 User Account Authentication

  Tunable: AuthServiceList FailureThreshold
  AN0495 macOS

  Detects exploitation attempts against macOS authentication frameworks such as OpenDirectory or Keychain. Defender perspective includes abnormal crashes in opendirectoryd, unauthorized Keychain API usage, and unusual sudo or login events. Correlation links unexpected process behavior with credential access anomalies.

  macos:unifiedlog opendirectoryd crashes or abnormal authentication errors → DC0038 Application Log Content

  macos:osquery execve: Processes unexpectedly invoking Keychain or authentication APIs → DC0032 Process Creation

  Tunable: WatchedAPIs CrashCorrelationWindow
  AN0496 Identity Provider

  Detects exploitation of vulnerabilities in cloud identity providers (IdPs) such as Azure AD or Okta for credential access. Defender perspective includes anomalous token creation or renewal, authentication bypass events, and API abuse to mint unauthorized tokens. Correlation highlights exploitation attempts tied to absent or inconsistent audit logs.

  azure:signinlogs TokenIssued, TokenRenewed: Unexpected or anomalous token issuance events → DC0002 User Account Authentication

  m365:unified ConsentGranted: Abuse of application integrations to mint tokens bypassing MFA → DC0038 Application Log Content

  Tunable: TokenAnomalyThreshold MonitoredAppIntegrations

Sigma rules tagged attack.t1212 (5)