Coverage › CVE-2018-4878
CVE-2018-4878 Mapped Sigma
Adobe Flash Player Use-After-Free Vulnerability
- Vendor / product
- Adobe — Flash Player
- Description (CISA)
- Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
- Added to KEV
- 2021-11-03
- Due date
- 2022-05-03
- Required action
- The impacted product is end-of-life and should be disconnected if still in use.
- Known ransomware use
- Known
- CWE
- CWE-416
- CISA notes
- https://nvd.nist.gov/vuln/detail/CVE-2018-4878
- Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1204.002 Malicious File | exploitation technique | The exploitation technique for this vulnerability is based on a vulnerability in Client software. In the wild, this was seen to be exploited by a malicious excel file.
The observed goals of this exploit from Group 123 are remote access and data exfiltration. ref 1 · ref 2 |
live |
| T1041 Exfiltration Over C2 Channel | secondary impact | The exploitation technique for this vulnerability is based on a vulnerability in Client software. In the wild, this was seen to be exploited by a malicious excel file.
The observed goals of this exploit from Group 123 are remote access and data exfiltration. ref 1 · ref 2 |
live |
| T1219 Remote Access Tools | primary impact | The exploitation technique for this vulnerability is based on a vulnerability in Client software. In the wild, this was seen to be exploited by a malicious excel file.
The observed goals of this exploit from Group 123 are remote access and data exfiltration.
Installation of the remote access software could allow for a number of different secondary impacts. See the MITRE ATT&CK reference on the DOGCALL software for more information. ref 1 · ref 2 |
live renamed from “Remote Access Software” |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1041 Exfiltration Over C2 Channel secondary impact
- DET0348 Detection Strategy for Exfiltration Over C2 Channel
AN0988 WindowsIdentifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access.Tunable:
DataVolumeThresholdKnownBenignProcessesAN0989 LinuxMonitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads.Tunable:OutboundEntropyScoreConnectionDurationAN0990 macOSDetects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios.Tunable:ParentProcessAncestryProtocolListAN0991 ESXiDetects VMs sending outbound traffic through non-standard services or to unknown destinations. Exfiltration over reverse shells tunneled via VMkernel or custom payloads routed via hostd/vpxa.Tunable:GuestOSAllowListTransferSizeThresholdMBProtocolAllowList
Sigma rules tagged attack.t1041 (5)
Author: Florian Roth (Nextron Systems)
· 2024-05-31 · logsource: product=windows category=network_connection · 07837ab9-60e1-481f-a74d-c31fb496a94c
Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors
Author: Florian Roth (Nextron Systems)
· 2017-04-15 (modified 2021-11-27) · logsource: category=firewall · 881834a4-6659-4773-821e-1c151789d873
Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · b4e6b016-a2ac-4759-ad85-8000b300d61e
Detects instances where a TFTP service on an OpenCanary node has had a request.
Author: Daniil Yugoslavskiy, oscd.community
· 2019-10-24 (modified 2024-01-18) · logsource: product=windows category=process_creation · c75309a3-59f8-4a8d-9c2c-4c927ad50555
Detects the execution of well known tools that can be abused for data exfiltration and tunneling.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 · logsource: product=linux category=process_creation · efd2eb09-b72e-4a61-8dc7-b1382a1e8983
Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.
T1204.002 Malicious File exploitation technique
- DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
AN0819 WindowsUser opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.Tunable:
TimeWindowSuspiciousExtensionsUserPathsParentAppsSignerAllowListAN0820 macOSUser opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.macos:unifiedlogprocess_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder}→ DC0032 Process Creationmacos:endpointsecurityES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions→ DC0039 File CreationTunable:TimeWindowQuarantineRequiredParentAppsAN0821 LinuxUser or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.auditd:SYSCALLopen/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions→ DC0039 File Creationauditd:SYSCALLexecve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser→ DC0032 Process CreationTunable:TimeWindowDesktopParentMap
Sigma rules tagged attack.t1204.002 (39)
Author: Florian Roth (Nextron Systems)
· 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19
Detects download of certain file types from hosts in suspicious TLDs
Author: Joseph Kamau
· 2024-05-27 (modified 2025-10-07) · logsource: product=windows category=process_creation · 1193d960-2369-499f-a158-7b50a31df682
Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.
Author: Steffen Rogge (dr0pd34d)
· 2024-07-10 · logsource: product=windows category=image_load · 1337afba-d17d-4d23-bd55-29b927603b30
Detects Microsoft Word loading an Add-In (.wll) file which can be used by threat actors for initial access or persistence.
Author: Michael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team
· 2022-02-28 (modified 2023-02-04) · logsource: product=windows category=process_creation · 208748f7-881d-47ac-a29c-07ea84bf691d
Detects a suspicious process spawning from an Outlook process.
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2022-08-10 (modified 2025-10-12) · logsource: product=windows category=file_event · 28208707-fe31-437f-9a7f-4b1108b94d2e
Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors.
These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers.
This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.
Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-03 · logsource: product=windows service=appxdeployment-server · 289dfa9e-e378-4a56-a9d4-7ed5ee218029
Detects successful MSIX/AppX package installations on Windows systems by monitoring EventID 854 in the Microsoft-Windows-AppXDeployment-Server/Operational log.
While most installations are legitimate, this can help identify unauthorized or suspicious package installations.
It is crucial to monitor such events as threat actors may exploit MSIX/AppX packages to deliver and execute malicious payloads.
Author: Florian Roth (Nextron Systems)
· 2020-05-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 29fd07fc-9cfd-4331-b7fd-cc18dfa21052
Detects specific process characteristics of Maze ransomware word document droppers
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=linux category=process_creation · 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e
Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.
Author: Pushkarev Dmitry
· 2020-06-28 (modified 2025-12-03) · logsource: product=windows service=applocker · 401e5d00-b944-11ea-8f9a-00163ecd60ae
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io
· 2018-04-06 (modified 2023-04-24) · logsource: product=windows category=process_creation · 438025f9-5856-4663-83f7-52f878a70a50
Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)
Author: Florian Roth (Nextron Systems)
· 2017-10-25 (modified 2022-08-08) · logsource: category=proxy · 4922a5dd-6743-4fc2-8e81-144374280997
Detects a flashplayer update from an unofficial location
Author: heyyanu
· 2026-03-26 · logsource: product=windows service=applocker · 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-05-02 (modified 2023-08-17) · logsource: product=windows category=registry_set · 60936b49-fca0-4f32-993d-7415edcf9a5d
A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.
Author: Florian Roth (Nextron Systems)
· 2017-11-23 (modified 2021-11-27) · logsource: product=windows category=process_creation · 678eb5f4-8597-4be6-8be7-905e4234b53a
Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe
Author: Sohan G (D4rkCiph3r)
· 2023-01-31 (modified 2023-02-04) · logsource: product=macos category=process_creation · 69483748-1525-4a6c-95ca-90dc8d431b68
Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution
All 39 rules on the technique page →
T1219 Remote Access Tools primary impact
- DET0496 Behavior-Chain Detection for Remote Access Tools (Tool-Agnostic)
AN1366 WindowsChain of remote access tool behavior: (1) initial execution of remote-control/assist agent or GUI under user context; (2) persistence via service or autorun; (3) long-lived outbound connection/tunnel to external infrastructure; (4) interactive control signals such as shell or file-manager child processes spawned by the RAT parent.Tunable:
TimeWindowUserContextProcessAllowlistInstallPathRegexExternalIPAllowlistShellSpawnRegexEgressHeuristicsAN1367 LinuxSequence of RAT agent execution, systemd persistence, and long-lived external egress; optional interactive shells spawned from the agent.auditd:SYSCALLexecve: Agent/headless flags (listen/connect/reverse/tunnel) or remote-control binaries spawning shells→ DC0032 Process Creationauditd:PATHWRITE: Drop of binaries/scripts in ~/.local, /tmp, or /opt tool dirs→ DC0039 File CreationTunable:TimeWindowDaemonAllowlistSuspiciousChildProcessesEgressHeuristicsAN1368 macOSElectron/GUI or headless RAT execution followed by LaunchAgent/Daemon persistence and persistent external connections; interactive children (osascript/sh/curl) spawned by parent.macos:unifiedlogProcess exec of remote-control apps or binaries with headless/connect flags→ DC0032 Process Creationmacos:osqueryCREATE/MODIFY: Creation of LaunchAgents/Daemons plists in user/system locations→ DC0039 File Creationmacos:osqueryCONNECT: Long-lived connections from remote-control parents to external IPs/domains→ DC0082 Network Connection CreationTunable:AllowedAppBundlePathsLaunchdAllowlistTimeWindowEgressHeuristics
Sigma rules tagged attack.t1219 (6)
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-28 (modified 2025-10-29) · logsource: product=windows category=process_creation · 2cf29f11-e356-4f61-98c0-1bdb9393d6da
Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server
mediumexperimental
Author: Ahmed Nosir (@egycondor)
· 2025-05-29 · logsource: product=windows category=process_creation · 2db93a3f-3249-4f73-9e68-0e77a0f8ae7e
Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line.
These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.
This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-08-29 · logsource: product=windows category=process_creation · 4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.
Author: @kostastsale
· 2026-02-19 · logsource: product=windows category=process_creation · 7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d
Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities.
This may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative activity or potential abuse of the remote access tool.
Threat actors may leverage OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.
Author: Nasreddine Bencherchali (Nextron Systems), citron_ninja
· 2023-10-25 (modified 2025-10-29) · logsource: product=windows category=process_creation · 90d6bd71-dffb-4989-8d86-a827fedd6624
Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Author: @kostastsale
· 2026-02-19 · logsource: product=windows category=file_event · 9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d
Detects the creation of potentially suspicious files by OpenEDR's ITSMService process.
The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.
While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.