Coverage › CVE-2021-42013
CVE-2021-42013 Mapped Sigma
Apache HTTP Server Path Traversal Vulnerability
- Vendor / product
- Apache — HTTP Server
- Description (CISA)
- Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.
- Added to KEV
- 2021-11-03
- Due date
- 2021-11-17
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Known
- CWE
- CWE-22
- CISA notes
- https://nvd.nist.gov/vuln/detail/CVE-2021-42013
- Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1210 Exploitation of Remote Services | exploitation technique | CVE-2021-42013 was introduced as the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50. CVE-2021-42013 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied," these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution. ref 1 · ref 2 |
live |
| T1059 Command and Scripting Interpreter | primary impact | CVE-2021-42013 was introduced as the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50. CVE-2021-42013 is a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows an attacker to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied," these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution. ref 1 · ref 2 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1059 Command and Scripting Interpreter primary impact
- DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
AN1428 WindowsDetects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.Tunable:
CommandLinePatternParentProcessNameTimeWindowAN1429 LinuxDetects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.Tunable:InterpreterNameUserContextExecutionChainLengthAN1430 macOSDetects launch of command-line interpreters via Terminal, Automator, or hiddenosascript, especially when parent process lineage deviates from user-initiated applications.macos:unifiedloglog stream --info --predicate 'eventMessage CONTAINS "exec"'→ DC0032 Process CreationTunable:LaunchAgentNameScriptNameTerminalAppUsageAN1431 ESXiDetects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.Tunable:ShellEnabledFlagSSHContextAN1432 Network DevicesIdentifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) viaenablemode or scripting-capable sessions used by uncommon accounts or from unknown IPs.Tunable:UserRoleDeviceType
Sigma rules tagged attack.t1059 (95)
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
Detects usage of winget to add new additional download sources
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Author: Josh Nickels, Marius Rothenbücher
· 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Author: Florian Roth (Nextron Systems)
· 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43
Detects Windows shells and scripting applications that write files to suspicious folders
Author: frack113, Tim Shelton (update fp)
· 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe.
This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs
process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other
processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
All 95 rules on the technique page →
T1210 Exploitation of Remote Services exploitation technique
- DET0118 Exploitation of Remote Services – multi-platform lateral movement detection
AN0327 WindowsCorrelates inbound network access to remote service ports (e.g., SMB/RPC 445/135, RDP 3389, WinRM 5985/5986) with near-time instability in the target service (crash, abnormal restart), suspicious child process creation under the service, and post-access lateral-movement behaviors. The chain indicates likely exploitation rather than normal administration.NSM:Flow
Inbound connections to 445, 3389, 5985-5986 with high error/connection-reset rate, followed by new outbound sessions from the same host to internal assets within short interval.→ DC0085 Network Traffic ContentTunable:ServicePortSetTimeWindowAllowedAdminCIDRsMinConnErrorRateAN0328 LinuxLinks inbound network access to SSHD/SMB/NFS/Databases or custom daemons with subsequent daemon crash/restart, core dump, or spawning of shells/reverse shells from the service context, indicating remote exploitation.linux:syslogkernel|systemd messages indicating 'segmentation fault'|'core dumped'|'service terminated unexpectedly' for sshd, smbd, vsftpd, mysqld, httpd, etc.→ DC0038 Application Log Contentauditd:SYSCALLexecve of /bin/sh,/bin/bash,/usr/bin/curl,/usr/bin/python by service accounts (e.g., apache, mysql, nobody) immediately after inbound network activity.→ DC0032 Process CreationNSM:FlowInbound connections to monitored service ports from external or unusual internal sources; rapid follow-on lateral connections from the same host.→ DC0085 Network Traffic ContentTunable:ServiceNamesCoreDumpPathsShellSpawnAllowlistTimeWindowAN0329 ESXiDetects exploitation targeting ESXi/vCenter by correlating attempts to reach known exploitable endpoints (OpenSLP 427, CIM 5989, Hostd/Vpxa HTTPS 443, ESXi SOAP) with vmkernel/hostd crashes, unexpected hostd/vpxa restarts, or new reverse/outbound connections from ESXi host/vCenter to internal assets.esxi:hostdKeywords: 'Backtrace','Signal 11','PANIC','hostd restarted','assert' or 'Service terminated unexpectedly' in /var/log/hostd.log, /var/log/vmkernel.log, /var/log/syslog.log.→ DC0038 Application Log ContentNSM:FlowInbound to tcp/427 (OpenSLP), tcp/443 (vSphere APIs), tcp/902, tcp/5989 followed by new unexpected outbound sessions from the ESXi/vCenter host.→ DC0085 Network Traffic ContentTunable:ESXiServicePortsMgmtCIDRsRestartKeywordsAN0330 macOSTies inbound access to exposed services (ARD/VNC 5900, SSH 22, ScreenSharing, web services) with process crashes in unified logs and abnormal child processes spawned under those services (e.g., bash, curl) to indicate exploitation.macos:unifiedlogprocess 'crashed'|'EXC_BAD_ACCESS' for sshd, screensharingd, httpd; launchd restarts of these daemons.→ DC0038 Application Log Contentmacos:osqueryparent_name in ('sshd','httpd','screensharingd') spawning shells or scripting runtimes.→ DC0032 Process CreationNSM:FlowInbound to 22/5900/8080 and follow-on internal connections.→ DC0085 Network Traffic ContentTunable:ServicePortSetAllowedAdminsTimeWindow
Sigma rules tagged attack.t1210 (15)
Author: Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT)
· 2023-11-27 · logsource: category=webserver · 04017cd5-621e-4ec4-a762-1f042fe3d3e5
Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing
Author: Florian Roth (Nextron Systems)
· 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
Author: Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community
· 2020-10-13 (modified 2021-05-30) · logsource: product=windows service=system · 18f37338-b9bd-4117-a039-280c81f7a596
This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.
Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro
· 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079
Detects WannaCry ransomware activity
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Author: Florian Roth (Nextron Systems)
· 2022-08-26 · logsource: product=windows category=process_creation · 60bfeac3-0d35-4302-8efb-1dd16f715bc6
Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)
Author: Florian Roth (Nextron Systems), Adam Bradbury (idea)
· 2019-06-02 (modified 2022-12-25) · logsource: product=windows service=security · 8400629e-79a9-4737-b387-5db940ab2367
Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep
Author: Muhammad Faisal (@faisalusuf)
· 2024-12-19 · logsource: product=windows category=dns_query · 882e858a-3233-4ba8-855e-2f3d3575803d
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.
Author: Lionel PRAT, Christophe BROCAS, @atc_project (improvements)
· 2019-05-24 (modified 2022-12-25) · logsource: product=windows service=system · aaa5b30d-f418-420b-83a0-299cb6024885
Detect suspicious error on protocol RDP, potential CVE-2019-0708
Author: Nate Guagenti (neu5ron)
· 2021-09-20 (modified 2025-11-03) · logsource: product=zeek service=http · ab6b1a39-a9ee-4ab4-b075-e83acf6e346b
Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request.
Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP).
Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.
Author: @Kostastsale, Nasreddine Bencherchali (Nextron Systems)
· 2022-10-07 (modified 2024-08-23) · logsource: product=windows category=process_creation · b0ce780f-10bd-496d-9067-066d23dc3aa5
Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS.
Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.
Author: Lars B. P. Frydenskov(Trifork Security)
· 2023-11-27 · logsource: category=webserver · ba5268de-4dd4-4d5c-8a90-2b5e6dc1aff8
Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise through insecure XML parsing using known public proof of concept code
Author: Florian Roth (Nextron Systems), @testanull
· 2021-11-18 (modified 2022-07-12) · logsource: product=windows service=msexchange-management · c92f1896-d1d2-43c3-92d5-7a5b35c217bb
Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321
Author: @Kostastsale, TheDFIRReport
· 2022-02-12 · logsource: product=windows category=process_creation · dcc6a01e-9471-44a0-a699-71ea96f8ed8b
Detects the execution of the commonly used ZeroLogon PoC executable.
Author: Florian Roth (Nextron Systems)
· 2019-01-22 (modified 2021-11-27) · logsource: service=apache · e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c
Detects an issue in apache logs that reports threading related errors