Coverage › CVE-2015-3113

CVE-2015-3113 Mapped Partial Sigma

Adobe Flash Player Heap-Based Buffer Overflow Vulnerability

Vendor / product

Adobe — Flash Player

Description (CISA)

Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.

Added to KEV

2022-04-13

Due date

2022-05-04

Required action

The impacted product is end-of-life and should be disconnected if still in use.

Known ransomware use

Unknown

CWE

CWE-119

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2015-3113

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1071.001 Web Protocols primary impact

• DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets
  AN0075 Windows

  Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.

  NSM:Flow http.log, ssl.log → DC0085 Network Traffic Content

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: ProcessNameExclusions UserAgentAnomalies OutboundByteRatioThreshold
  AN0076 Linux

  Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.

  NSM:Flow http.log, conn.log → DC0085 Network Traffic Content

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: CommandLinePatternMatch BeaconIntervalWindow
  AN0077 macOS

  Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).

  macos:osquery socket_events → DC0078 Network Traffic Flow

  macos:unifiedlog log stream --predicate → DC0064 Command Execution

  Tunable: SuspiciousParentProcess URIEntropyThreshold
  AN0078 ESXi

  Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.

  NSM:Flow SPAN or port-mirrored HTTP/S → DC0085 Network Traffic Content

  esxi:shell /root/.ash_history or /etc/init.d/* → DC0032 Process Creation

  Tunable: ShellScriptMatch ExternalConnectionFilter
  AN0079 Network Devices

  Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.

  NSM:Flow http.log, ssl.log, websocket.log → DC0085 Network Traffic Content

  Tunable: HeaderEncodingPattern TLSFingerprintMismatch

Sigma rules tagged attack.t1071.001 (42)

All 42 rules on the technique page →

T1204.002 Malicious File exploitation technique

• DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
  AN0819 Windows

  User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

  Tunable: TimeWindow SuspiciousExtensions UserPaths ParentApps SignerAllowList
  AN0820 macOS

  User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.

  macos:unifiedlog process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder} → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions → DC0039 File Creation

  Tunable: TimeWindow QuarantineRequired ParentApps
  AN0821 Linux

  User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.

  auditd:SYSCALL open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions → DC0039 File Creation

  auditd:SYSCALL execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser → DC0032 Process Creation

  Tunable: TimeWindow DesktopParentMap

Sigma rules tagged attack.t1204.002 (39)

All 39 rules on the technique page →

T1497 Virtualization/Sandbox Evasion secondary impact

• DET0046 Detection Strategy for T1497 Virtualization/Sandbox Evasion
  AN0127 Windows

  Execution of discovery commands or API calls for virtualization artifacts (e.g., registry keys, device drivers, services), sleep/skipped execution behavior, or sandbox evasion DLLs before payload deployment.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  Tunable: TimeWindow KnownVMArtifactList
  AN0128 Linux

  Execution of commands to enumerate virtualization-related files or processes (e.g., '/sys/class/dmi/id/product_name', dmesg, lscpu, lspci), or querying hypervisor interfaces prior to malware execution.

  auditd:SYSCALL execve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg) → DC0032 Process Creation

  auditd:SYSCALL sleep function usage or loops (nanosleep, usleep) in scripts → DC0064 Command Execution

  Tunable: TimeWindow CommandArtifactMatchList
  AN0129 macOS

  Execution of scripts or binaries that check for virtualization indicators (e.g., system_profiler, ioreg -l, kextstat), combined with delay functions or anomalous launchd activity.

  macos:unifiedlog execution of system_profiler, ioreg, kextstat with argument patterns related to VM/sandbox checks → DC0032 Process Creation

  macos:unifiedlog dynamic loading of sleep-related functions or sandbox detection libraries → DC0016 Module Load

  Tunable: ProcessCommandPattern SleepThreshold

Sigma rules tagged attack.t1497 (0)

None. MITRE's strategy above is the only public detection guidance for this technique.

T1622 Debugger Evasion secondary impact

• DET0371 Detection Strategy for Debugger Evasion (T1622)
  AN1045 Windows

  Monitor for suspicious use of Windows API calls such as IsDebuggerPresent() and NtQueryInformationProcess(), or processes manually checking the BeingDebugged flag in the Process Environment Block (PEB). Detect sequences of OutputDebugStringW() calls in short intervals that may indicate debugger flooding attempts.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  etw:Microsoft-Windows-Kernel-Process NtQueryInformationProcess → DC0021 OS API Execution

  Tunable: ApiCallFrequencyThreshold ProcessAllowList
  AN1046 Linux

  Monitor access to /proc/self/status where TracerPID field is queried, as this is a common technique for debugger detection. Detect processes that attempt to trigger exceptions intentionally and monitor whether exception handling indicates presence of a debugger.

  auditd:SYSCALL open/read: Access to /proc/self/status with focus on TracerPID field → DC0055 File Access

  Tunable: MonitoredPaths SyscallThreshold
  AN1047 macOS

  Detect suspicious calls to sysctl or ptrace API used to determine if a process is being debugged. Monitor for processes that flood OutputDebugString equivalents or generate abnormal exceptions to evade analysis.

  macos:unifiedlog ptrace: Processes invoking ptrace with PTRACE_TRACEME flag → DC0021 OS API Execution

  Tunable: PtraceInvocationThreshold DevToolExclusionList

Sigma rules tagged attack.t1622 (1)