Coverage › CVE-2021-1497

CVE-2021-1497 Mapped Sigma

Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability

Vendor / product

Cisco — HyperFlex HX

Description (CISA)

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user.

Added to KEV

2021-11-03

Due date

2021-11-17

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

CWE-78

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2021-1497

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059 Command and Scripting Interpreter primary impact

• DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
  AN1428 Windows

  Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: CommandLinePattern ParentProcessName TimeWindow
  AN1429 Linux

  Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: InterpreterName UserContext ExecutionChainLength
  AN1430 macOS

  Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

  macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

  Tunable: LaunchAgentName ScriptName TerminalAppUsage
  AN1431 ESXi

  Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

  esxi:vobd shell session start → DC0064 Command Execution

  Tunable: ShellEnabledFlag SSHContext
  AN1432 Network Devices

  Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

  networkdevice:cli shell command → DC0064 Command Execution

  networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

  Tunable: UserRole DeviceType

Sigma rules tagged attack.t1059 (95)

All 95 rules on the technique page →

T1133 External Remote Services exploitation technique

• DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
  AN1004 Windows

  Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Application VPN, Citrix, or remote access gateway logs showing external IP addresses → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: BusinessHours KnownRemoteIPs FailedLogonThreshold GeoIPWhitelist TimeWindow
  AN1005 Linux

  Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).

  auditd:SYSCALL ssh logins or execve of remote commands → DC0088 Logon Session Metadata

  NSM:Connections Failed password or accepted password for SSH users → DC0038 Application Log Content

  NSM:Flow connection: Inbound connections to SSH or VPN ports → DC0082 Network Connection Creation

  Tunable: KnownSSHClients FailedLogonThreshold TimeWindow
  AN1006 macOS

  Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.

  macos:unifiedlog Remote login (ssh) or screen sharing authentication attempts → DC0088 Logon Session Metadata

  macos:unifiedlog Inbound connections to VNC/SSH ports → DC0082 Network Connection Creation

  PF:Logs External traffic to remote access services → DC0078 Network Traffic Flow

  Tunable: KnownVNCServers TimeWindow
  AN1007 Containers

  Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.

  ApplicationLog:API Docker/Kubernetes API access from external sources → DC0038 Application Log Content

  kubernetes:audit Unauthorized container creation or kubelet exec logs → DC0088 Logon Session Metadata

  NSM:Flow External access to container ports (2375, 6443) → DC0082 Network Connection Creation

  Tunable: AllowedCIDRs TimeWindow

Sigma rules tagged attack.t1133 (20)

All 20 rules on the technique page →