Coverage › CVE-2021-44515

CVE-2021-44515 Mapped Sigma

Zoho Desktop Central Authentication Bypass Vulnerability

Vendor / product: Zoho — Desktop Central
Description (CISA): Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
Added to KEV: 2021-12-10
Due date: 2021-12-24
Required action: Apply updates per vendor instructions.
Known ransomware use: Unknown
CWE: none recorded by CISA
CISA notes: https://nvd.nist.gov/vuln/detail/CVE-2021-44515
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

5 mapping objects across 5 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1190 Exploit Public-Facing Application	exploitation technique	CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating domain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. ref 1 · ref 2	live
T1003 OS Credential Dumping	secondary impact	CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating domain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. ref 1 · ref 2	live
T1069 Permission Groups Discovery	secondary impact	CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating domain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. ref 1 · ref 2	live
T1087 Account Discovery	secondary impact	CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating domain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. ref 1 · ref 2	live
T1105 Ingress Tool Transfer	primary impact	CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating domain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. ref 1 · ref 2	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1003 OS Credential Dumping secondary impact

DET0234 Credential Dumping via Sensitive Memory and Registry Access Correlation
AN0648 Windows
Processes accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.

WinEventLog:Sysmon EventCode=10 → DC0035 Process Access
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access
WinEventLog:Security EventCode=4662 → DC0071 Active Directory Object Access

Tunable: AccessMask TimeWindow ParentProcessFilter

AN0649 Linux
Processes opening /proc//mem or /proc//maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.

auditd:SYSCALL open → DC0055 File Access
auditd:SYSCALL ptrace → DC0035 Process Access
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: TargetProcessName ToolProcessName

AN0650 macOS
Unsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.

macos:unifiedlog Code Execution & Entitlement Access → DC0034 Process Metadata
macos:keychain Access to Keychain DB or system.keychain → DC0055 File Access
macos:osquery Invocation of osascript or dylib injection → DC0032 Process Creation

Tunable: KeychainAccessPath SignedBinaryStatus

Sigma rules tagged `attack.t1003` (37)

Potential Credential Dumping Attempt Using New NetworkProvider - REG mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-08-23 (modified 2023-08-17) · logsource: product=windows category=registry_set · 0442defa-b4a2-41c9-ae2c-ea7042fc4701

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Techniques: T1003

Potential Invoke-Mimikatz PowerShell Script hightest

Author: Tim Rauch, Elastic (idea) · 2022-09-28 · logsource: product=windows category=ps_script · 189e3b02-82b2-4b90-9662-411eb64486d4

Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.

Techniques: T1003

WCE wceaux.dll Access criticaltest

Author: Thomas Patzke · 2017-06-14 (modified 2025-01-30) · logsource: product=windows service=security · 1de68c67-af5c-4097-9c85-fe5578e09e67

Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host

Techniques: T1003

Hacktool Execution - Imphash criticaltest

Author: Florian Roth (Nextron Systems) · 2022-03-04 (modified 2024-11-23) · logsource: product=windows category=process_creation · 24e3e58a-646b-4b50-adef-02ef935b9fc8

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Techniques: T1588.002 T1003

Suspicious SYSTEM User Process Creation hightest

Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) · 2021-12-20 (modified 2025-10-19) · logsource: product=windows category=process_creation · 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Techniques: T1134 T1003 T1027

Microsoft IIS Service Account Password Dumped hightest

Author: Tim Rauch, Janantha Marasinghe, Elastic (original idea) · 2022-11-08 (modified 2023-01-22) · logsource: product=windows category=process_creation · 2d3cdeec-c0db-45b4-aa86-082f7eb75701

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

Techniques: T1003

HackTool - Rubeus Execution - ScriptBlock hightest

Author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems) · 2023-04-27 · logsource: product=windows category=ps_script · 3245cd30-e015-40ff-a31d-5cadd5f377ec

Detects the execution of the hacktool Rubeus using specific command line flags

Techniques: T1003 T1558.003 T1550.003

Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 mediumexperimental

Author: Milad Cheraghi · 2026-04-28 · logsource: product=linux category=process_creation · 33b3cfb1-574e-44b9-b527-fbf9303b9d7b

Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2. Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges. These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets. CVE-2025-5054: Information leak via core dumps from SUID binaries using apport. CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.

Techniques: T1548 T1003

CVE tags: CVE-2025-5054CVE-2025-4598

Loaded Module Enumeration Via Tasklist.EXE mediumtest

Author: Swachchhanda Shrawan Poudel · 2024-02-12 (modified 2024-03-13) · logsource: product=windows category=process_creation · 34275eb8-fa19-436b-b959-3d9ecd53fa1f

Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.

Techniques: T1003

Hacktool Execution - PE Metadata hightest

Author: Florian Roth (Nextron Systems) · 2022-04-27 (modified 2024-01-15) · logsource: product=windows category=process_creation · 37c1333a-a0db-48be-b64b-7393b2386e3b

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Techniques: T1588.002 T1003

OpenCanary - MSSQL Login Attempt Via SQLAuth hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.

Techniques: T1003 T1213

Credential Manager Access By Uncommon Applications mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-11 (modified 2026-07-28) · logsource: product=windows category=file_access · 407aecb1-e762-4acf-8c7b-d087bcff3bb6

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

Techniques: T1003

Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-27 (modified 2026-01-09) · logsource: product=windows category=image_load · 416bc4a2-7217-4519-8dc7-c3271817f1d5

Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.

Techniques: T1003 T1685

Linux Keylogging with Pam.d hightest

Author: Pawel Mazur · 2021-05-24 (modified 2022-12-18) · logsource: product=linux service=auditd · 49aae26c-450e-448b-911d-b3c13d178dfc

Detect attempt to enable auditing of TTY input

Techniques: T1003 T1056.001

OpenCanary - REDIS Action Command Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 547dfc53-ebf6-4afe-8d2e-793d9574975d

Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.

Techniques: T1003 T1213

All 37 rules on the technique page →

T1069 Permission Groups Discovery secondary impact

DET0179 Behavioral Detection of Permission Groups Discovery
AN0507 Windows
Detection of adversary enumeration of domain or local group memberships via native tools such as net.exe, PowerShell, or WMI. This activity may precede lateral movement or privilege escalation.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

Tunable: CommandLineRegex TimeWindow UserContext

AN0508 Linux
Detection of group enumeration using commands like 'id', 'groups', or 'getent group', often followed by privilege escalation or SSH lateral movement.

auditd:SYSCALL execve → DC0032 Process Creation

Tunable: CommandLine TTYSession

AN0509 macOS
Group membership checks via 'dscl', 'dscacheutil', or 'id', typically executed via terminal or automation scripts.

macos:unifiedlog process:launch → DC0032 Process Creation

Tunable: CommandLine ParentProcess

Sigma rules tagged `attack.t1069` (3)

Malicious PowerShell Commandlets - ProcessCreation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - PoshModule hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - ScriptBlock hightest

Author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer · 2017-03-05 (modified 2025-12-10) · logsource: product=windows category=ps_script · 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

T1087 Account Discovery secondary impact

DET0587 Enumeration of User or Account Information Across Platforms
AN1612 Windows
Detection of processes performing local or domain account enumeration by invoking account directory queries or security APIs followed by structured output of account lists. The defender observes command execution or API invocation patterns that retrieve account information and produce enumeration artifacts shortly afterward.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Security EventCode=4798, 4799 → DC0099 Group Enumeration

Tunable: CommandLinePattern TimeWindow UserContext

AN1613 Linux
Enumeration of users and groups through suspicious shell commands or unauthorized access to /etc/passwd or /etc/shadow.

auditd:SYSCALL PATH → DC0055 File Access
linux:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: AccessedFile ParentProcessName

AN1614 macOS
Detection of account enumeration through directory service queries or system utilities accessing account metadata stores, followed by structured enumeration output.

macos:unifiedlog process event → DC0032 Process Creation
macos:unifiedlog DirectoryService queries retrieving account information → DC0013 User Account Metadata

Tunable: CommandLine ExecutionContext

AN1615 IaaS
Detection of enumeration of identity entities through cloud provider APIs where principals retrieve account metadata such as IAM users or roles in rapid succession.

AWS:CloudTrail DescribeUsers / ListUsers / GetUser → DC0083 Cloud Service Enumeration

Tunable: API_Method CallerType

AN1616 Identity Provider
Detection of identity directory enumeration through API calls or administrative queries retrieving multiple account objects within a short interval.

azure:signinlogs Graph API Query → DC0083 Cloud Service Enumeration
saas:okta User Enumeration Events → DC0013 User Account Metadata

Tunable: QueryType AppContext

AN1617 ESXi
Detection of enumeration activity when system processes query ESXi host account configuration or management APIs to retrieve user account listings.

esxi:vpxd vCenter Management → DC0064 Command Execution

Tunable: CommandPattern PrivilegedSession

AN1618 SaaS
Account enumeration via bulk access to user directory features or hidden APIs.

gcp:audit Directory API Access → DC0013 User Account Metadata

Tunable: EndpointURL UserAgent

AN1619 Office Suite
Account discovery via VBA macros, COM objects, or embedded scripting.

m365:unified Scripted Activity → DC0029 Script Execution

Tunable: MacroName ExecutionScope

Sigma rules tagged `attack.t1087` (16)

Malicious PowerShell Commandlets - ProcessCreation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-12-10) · logsource: product=windows category=process_creation · 02030f2f-6199-49ec-b258-ea71b07e03dc

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Hacktool Ruler hightest

Author: Florian Roth (Nextron Systems) · 2017-05-31 (modified 2022-10-09) · logsource: product=windows service=security · 24549159-ac1b-479c-8175-d42aea947cae

This events that are generated when using the hacktool Ruler by Sensepost

Techniques: T1087 T1114 T1059 T1550.002

PUA - Seatbelt Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-18 (modified 2023-02-04) · logsource: product=windows category=process_creation · 38646daa-e78f-4ace-9de0-55547b2d30da

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

Techniques: T1526 T1087 T1083

Webshell Hacking Activity Patterns hightest

Author: Florian Roth (Nextron Systems) · 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Techniques: T1505.003 T1018 T1033 T1087

SharpHound Recon Account Discovery hightest

Author: Sagie Dulce, Dekel Paz · 2022-01-01 · logsource: product=rpc_firewall category=application · 65f77b1e-8e79-45bf-bb67-5988a8ce45a5

Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

Techniques: T1087

Potential Pikabot Discovery Activity hightest

Author: Andreas Braathen (mnemonic.io) · 2023-10-27 (modified 2024-01-26) · logsource: product=windows category=process_creation · 698d4431-514f-4c82-af4d-cf573872a9f5

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

Techniques: T1016 T1049 T1087

Malicious PowerShell Commandlets - PoshModule hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-20 (modified 2025-12-10) · logsource: product=windows category=ps_module · 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

Malicious PowerShell Commandlets - ScriptBlock hightest

Detects Commandlet names from well-known PowerShell exploitation frameworks

Techniques: T1482 T1087 T1087.001 T1087.002 T1069.001 T1069.002 T1069 T1059.001

HackTool - winPEAS Execution hightest

Author: Georg Lauenstein (sure[secure]) · 2022-09-19 (modified 2023-03-23) · logsource: product=windows category=process_creation · 98b53e78-ebaf-46f8-be06-421aafd176d9

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Techniques: T1082 T1087 T1046

Suspicious Use of PsLogList mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2021-12-18 (modified 2026-06-29) · logsource: product=windows category=process_creation · aae1243f-d8af-40d8-ab20-33fc6d0c55bc

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Techniques: T1087 T1087.001 T1087.002

Uncommon Connection to Active Directory Web Services mediumtest

Author: @kostastsale · 2024-01-26 · logsource: product=windows category=network_connection · b3ad3c0f-c949-47a1-a30e-b0491ccae876

Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.

Techniques: T1087

Potentially Suspicious EventLog Recon Activity Using Log Query Utilities mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2022-09-09 (modified 2025-12-02) · logsource: product=windows category=process_creation · beaa66d6-aa1b-4e3c-80f5-e0145369bfaf

Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.

Techniques: T1552 T1087

Webshell Detection With Command Line Keywords hightest

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson · 2017-01-01 (modified 2026-07-14) · logsource: product=windows category=process_creation · bed2a484-9348-4143-8a8a-b801c979301c

Detects certain command line parameters often used during reconnaissance activity via web shells

Techniques: T1505.003 T1018 T1033 T1087

Network Reconnaissance Activity hightest

Author: Florian Roth (Nextron Systems) · 2022-02-07 · logsource: product=windows category=process_creation · e6313acd-208c-44fc-a0ff-db85d572e90e

Detects a set of suspicious network related commands often used in recon stages

Techniques: T1087 T1082

HackTool - SOAPHound Execution hightest

Author: @kostastsale · 2024-01-26 · logsource: product=windows category=process_creation · e92a4287-e072-4a40-9739-370c106bb750

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

Techniques: T1087

All 16 rules on the technique page →

T1105 Ingress Tool Transfer primary impact

DET0060 Detect Ingress Tool Transfers via Behavioral Chain
AN0165 Windows
Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).

WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: ParentProcessName DestinationIPCategory FilePathRegex

AN0166 Linux
Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.

auditd:SYSCALL connect, execve, write → DC0064 Command Execution
auditd:SYSCALL file creation/modification → DC0039 File Creation
iptables:LOG TCP connections → DC0078 Network Traffic Flow

Tunable: ToolName DownloadExtension

AN0167 macOS
Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.

macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation
macos:unifiedlog file write/create → DC0039 File Creation
macos:unifiedlog connection open → DC0082 Network Connection Creation

Tunable: DirectoryTargeted ProcessPath

AN0168 ESXi
Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.

esxi:hostd command execution → DC0064 Command Execution
esxi:vmkernel file write → DC0039 File Creation

Tunable: ToolName DatastorePath

AN0169 Network Devices
Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

NSM:Flow connection metadata → DC0078 Network Traffic Flow
snmp:syslog firmware write/log event → DC0039 File Creation

Tunable: PayloadVolumeThreshold ProtocolUsed

Sigma rules tagged `attack.t1105` (87)

Suspicious Curl File Upload - Linux mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) · 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582

Detects a suspicious curl process start the adds a file to a web request

Techniques: T1567 T1105

Potential Data Exfiltration Via Curl.EXE mediumtest

Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update) · 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04

Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration

Techniques: T1567 T1105

Suspicious Download from Office Domain hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-12-27 (modified 2022-08-02) · logsource: product=windows category=process_creation · 00d49ed5-4491-4271-a8db-650a4ef6f8c1

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Techniques: T1105 T1608

Potential COM Objects Download Cradles Usage - Process Creation mediumtest

Author: frack113 · 2022-12-25 · logsource: product=windows category=process_creation · 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Techniques: T1105

Insensitive Subfolder Search Via Findstr.EXE lowtest

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Techniques: T1218 T1564.004 T1552.001 T1105

Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

Techniques: T1218 T1105

CVE tags: CVE-2025-33053

Local Network Connection Initiated By Script Interpreter mediumtest

Author: frack113 · 2022-08-28 (modified 2024-05-31) · logsource: product=windows category=network_connection · 08249dc0-a28d-4555-8ba5-9255a198e08c

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

Techniques: T1105

Axios NPM Compromise Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

Techniques: T1195.002 T1059.006 T1059.004 T1105

Uncommon Network Connection Initiated By Certutil.EXE hightest

Author: frack113, Florian Roth (Nextron Systems) · 2022-09-02 (modified 2024-05-31) · logsource: product=windows category=network_connection · 0dba975d-a193-4ed1-a067-424df57570d1

Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.

Techniques: T1105

File Download with Headless Browser hightest

Author: Sreeman, Florian Roth (Nextron Systems) · 2022-01-04 (modified 2025-10-07) · logsource: product=windows category=process_creation · 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Techniques: T1105 T1564.003

Potential DLL File Download Via PowerShell Invoke-WebRequest mediumtest

Author: Florian Roth (Nextron Systems), Hieu Tran · 2023-03-13 (modified 2025-07-18) · logsource: product=windows category=process_creation · 0f0450f3-8b47-441e-a31b-15a91dc243e2

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.

Techniques: T1059.001 T1105

Potential In-Memory Download And Compile Of Payloads mediumtest

Author: Sohan G (D4rkCiph3r), Red Canary (idea) · 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Techniques: T1059.007 T1105

Suspicious File Downloaded From Direct IP Via Certutil.EXE hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Techniques: T1027 T1105

Suspicious Diantz Download and Compress Into a CAB File mediumtest

Author: frack113 · 2021-11-26 (modified 2022-08-13) · logsource: product=windows category=process_creation · 185d7418-f250-42d0-b72e-0c8b70661e93

Download and compress a remote file and store it in a cab file on local machine.

Techniques: T1105

Download from Suspicious Dyndns Hosts mediumtest

Author: Florian Roth (Nextron Systems) · 2017-11-08 (modified 2023-05-18) · logsource: category=proxy · 195c1119-ef07-4909-bb12-e66f5e07bf3c

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Techniques: T1105 T1568

All 87 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
AN0219 Windows
Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList

AN0220 Linux
Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content
auditd:SYSCALL execve → DC0032 Process Creation
NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

Tunable: WebProcList ChildToolList BurstThreshold TimeWindow

AN0221 macOS
Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content
macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation
NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

Tunable: ServiceList TimeWindow

AN0222 Containers
Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content
docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation
NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

Tunable: IngressNamespaces MetadataEndpoints TimeWindow

AN0223 IaaS
Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content
AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

Tunable: LBProjects ErrorBurst

AN0224 ESXi
Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content
NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

Tunable: MgmtCIDR TimeWindow

AN0225 Network Devices
Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content
NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged `attack.t1190` (149)

Potential CVE-2023-25717 Exploitation Attempt hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-30 · logsource: category=webserver · 043c1609-0e32-4462-a6f2-5a0c2da3fafe

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Techniques: T1190

CVE tags: CVE-2023-25717

Potential CVE-2021-27905 Exploitation Attempt mediumtest

Author: @gott_cyber · 2022-12-11 (modified 2023-03-24) · logsource: category=webserver · 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Techniques: T1190

CVE tags: CVE-2021-27905

Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 criticaltest

Author: Florian Roth (Nextron Systems) · 2020-07-10 (modified 2023-01-02) · logsource: category=webserver · 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Techniques: T1190

CVE tags: CVE-2020-8193CVE-2020-8195

Ruby on Rails Framework Exceptions mediumstable

Author: Thomas Patzke · 2017-08-06 (modified 2020-09-01) · logsource: product=ruby_on_rails category=application · 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Techniques: T1190

Potential CVE-2023-23752 Exploitation Attempt hightest

Author: Bhabesh Raj · 2023-02-23 · logsource: category=webserver · 0e1ebc5a-15d0-4bf6-8199-b2535397433a

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Techniques: T1190

CVE tags: CVE-2023-23752

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Terminal Service Process Spawn hightest

Author: Florian Roth (Nextron Systems) · 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Techniques: T1190 T1210

RDS Database Security Group Modification mediumtest

Author: jamesc-grafana · 2024-07-11 · logsource: product=aws service=cloudtrail · 14f3f1c8-02d5-43a2-a191-91ffb52d3015

Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.

Techniques: T1190

Cisco ASA Exploitation Activity - Proxy highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-20 · logsource: category=proxy · 15697955-6a29-47ca-92e9-0e05efae3260

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

Techniques: T1190

CVE tags: CVE-2025-20333CVE-2025-20362

TerraMaster TOS CVE-2020-28188 hightest

Author: Bhabesh Raj · 2021-01-25 (modified 2023-01-02) · logsource: category=webserver · 15c312b9-00d0-4feb-8870-7d940a4bdc5e

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Techniques: T1190

CVE tags: CVE-2020-28188

Potential Server Side Template Injection In Velocity hightest

Author: Moti Harmats · 2023-02-11 · logsource: product=velocity category=application · 16c86189-b556-4ee8-b4c7-7e350a195a4f

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Techniques: T1190

CVE-2021-21972 VSphere Exploitation hightest

Author: Bhabesh Raj · 2021-02-24 (modified 2023-01-02) · logsource: category=webserver · 179ed852-0f9b-4009-93a7-68475910fd86

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

Techniques: T1190

CVE tags: CVE-2021-21972

Potential OWASSRF Exploitation Attempt - Webserver hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-22 (modified 2023-01-02) · logsource: category=webserver · 181f49fa-0b21-4665-a98c-a57025ebb8c7

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Techniques: T1190

Suspicious User-Agents Related To Recon Tools mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton · 2022-07-19 (modified 2026-06-11) · logsource: category=webserver · 19aa4f58-94ca-45ff-bc34-92e533c0994a

Detects known suspicious (default) user-agents related to scanning/recon tools

Techniques: T1190

Python SQL Exceptions mediumstable

Author: Thomas Patzke · 2017-08-12 (modified 2020-09-01) · logsource: product=python category=application · 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9

Generic rule for SQL exceptions in Python according to PEP 249

Techniques: T1190

All 149 rules on the technique page →

CVE-2021-44515 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1003 OS Credential Dumping secondary impact

Sigma rules tagged attack.t1003 (37)

T1069 Permission Groups Discovery secondary impact

Sigma rules tagged attack.t1069 (3)

T1087 Account Discovery secondary impact

Sigma rules tagged attack.t1087 (16)

T1105 Ingress Tool Transfer primary impact

Sigma rules tagged attack.t1105 (87)

T1190 Exploit Public-Facing Application exploitation technique

Sigma rules tagged attack.t1190 (149)

Sigma rules tagged `attack.t1003` (37)

Sigma rules tagged `attack.t1069` (3)

Sigma rules tagged `attack.t1087` (16)

Sigma rules tagged `attack.t1105` (87)

Sigma rules tagged `attack.t1190` (149)