Coverage › CVE-2022-22963

CVE-2022-22963 Mapped Sigma

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

Vendor / product: VMware Tanzu — Spring Cloud
Description (CISA): When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Added to KEV: 2022-08-25
Due date: 2022-09-15
Required action: Apply updates per vendor instructions.
Known ransomware use: Unknown
CWE: CWE-94
CISA notes: https://tanzu.vmware.com/security/cve-2022-22963
https://nvd.nist.gov/vuln/detail/CVE-2022-22963
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1190 Exploit Public-Facing Application	exploitation technique	In certain versions of Spring Cloud Function, a vulnerability allows remote code execution through a specially crafted Spring Expression Language (SpEL) routing expression. This vulnerability, known as "Spring4Shell," can be exploited by sending crafted queries to a server running the Spring Core framework. Hackers are actively exploiting this flaw to execute malicious Java code on vulnerable servers. Initial exploit attempts were observed targeting a honeypot on port 9001. The exploit modifies logging configurations to create a webshell by writing code to a log file, which is then executed via a browser. Although there is scanning activity for vulnerable hosts, the exploitation is less widespread compared to Log4Shell, as it requires specific conditions beyond just using the framework. ref 1 · ref 2 · ref 3 · ref 4	live
T1059.007 JavaScript	primary impact	In certain versions of Spring Cloud Function, a vulnerability allows remote code execution through a specially crafted Spring Expression Language (SpEL) routing expression. This vulnerability, known as "Spring4Shell," can be exploited by sending crafted queries to a server running the Spring Core framework. Hackers are actively exploiting this flaw to execute malicious Java code on vulnerable servers. Initial exploit attempts were observed targeting a honeypot on port 9001. The exploit modifies logging configurations to create a webshell by writing code to a log file, which is then executed via a browser. Although there is scanning activity for vulnerable hosts, the exploitation is less widespread compared to Log4Shell, as it requires specific conditions beyond just using the framework. ref 1 · ref 2 · ref 3 · ref 4	live
T1505.003 Web Shell	secondary impact	In certain versions of Spring Cloud Function, a vulnerability allows remote code execution through a specially crafted Spring Expression Language (SpEL) routing expression. This vulnerability, known as "Spring4Shell," can be exploited by sending crafted queries to a server running the Spring Core framework. Hackers are actively exploiting this flaw to execute malicious Java code on vulnerable servers. Initial exploit attempts were observed targeting a honeypot on port 9001. The exploit modifies logging configurations to create a webshell by writing code to a log file, which is then executed via a browser. Although there is scanning activity for vulnerable hosts, the exploitation is less widespread compared to Log4Shell, as it requires specific conditions beyond just using the framework. ref 1 · ref 2 · ref 3 · ref 4	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059.007 JavaScript primary impact

DET0264 Cross-Platform Detection of JavaScript Execution Abuse
AN0733 Windows
Detects JavaScript execution through WSH (wscript.exe, cscript.exe) or HTA (mshta.exe), particularly when spawned from Office macros, web browsers, or abnormal user paths. Correlates script execution with outbound network activity or system modification.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
m365:defender ScriptBlockLogging + AMSI → DC0029 Script Execution
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

Tunable: ParentProcess ScriptPath TimeWindow UserContext EntropyScore

AN0734 macOS
Detects JavaScript for Automation (JXA) via osascript or compiled scripts using OSAKit APIs. Flags execution involving system modification, inter-process scripting, or browser abuse.

macos:unifiedlog log stream with predicate 'eventMessage CONTAINS "osascript"' → DC0029 Script Execution
macos:osquery process_events → DC0032 Process Creation
macos:syslog /var/log/system.log → DC0064 Command Execution

Tunable: ScriptLocation ParentProcess APIInvocation

AN0735 Linux
Detects Node.js or JavaScript interpreter execution from web shells, cron jobs, or local users. Correlates execution with reverse shell behavior, file modifications, or abnormal outbound connections.

auditd:SYSCALL execve → DC0032 Process Creation
linux:syslog /var/log/syslog → DC0029 Script Execution

Tunable: ScriptPath BinaryName UserExecutionContext NetworkFollowUp

Sigma rules tagged `attack.t1059.007` (29)

WScript or CScript Dropper - File hightest

Author: Tim Shelton · 2022-01-10 (modified 2026-02-17) · logsource: product=windows category=file_event · 002bdb95-0cf1-46a6-9e08-d38c128a6127

Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe

Techniques: T1059.005 T1059.007

XSL Script Execution Via WMIC.EXE mediumtest

Author: Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel · 2019-10-21 (modified 2026-01-24) · logsource: product=windows category=process_creation · 05c36dd6-79d6-4a9a-97da-3db20298ab2d

Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

Techniques: T1047 T1220 T1059.005 T1059.007

Adwind RAT / JRAT File Artifact hightest

Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community · 2017-11-10 (modified 2022-12-02) · logsource: product=windows category=file_event · 0bcfabcb-7929-47f4-93d6-b33fb67d34d1

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Techniques: T1059.005 T1059.007

Script Interpreter Spawning Credential Scanner - Windows highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

Techniques: T1552 T1005 T1059.007

Potential In-Memory Download And Compile Of Payloads mediumtest

Author: Sohan G (D4rkCiph3r), Red Canary (idea) · 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Techniques: T1059.007 T1105

WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript mediumtest

Author: Michael Haag · 2019-01-16 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1e33157c-53b1-41ad-bbcc-780b80b58288

Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh) by Wscript/Cscript.

Techniques: T1059.005 T1059.007

Adwind RAT / JRAT hightest

Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community · 2017-11-10 (modified 2022-10-09) · logsource: product=windows category=process_creation · 1fac1481-2dbc-48b2-9096-753c49b4ec71

Detects javaw.exe in AppData folder as used by Adwind / JRAT

Techniques: T1059.005 T1059.007

TanStack Supply-Chain Attack File Creation Indicators - Linux mediumexperimental

Author: Leonardo Gasparini · 2026-05-12 · logsource: product=linux category=file_event · 2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d

Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.

Techniques: T1195.002 T1059.007 T1547.004

HackTool - CACTUSTORCH Remote Thread Creation hightest

Author: @SBousseaden (detection), Thomas Patzke (rule) · 2019-02-01 (modified 2023-05-05) · logsource: product=windows category=create_remote_thread · 2e4e488a-6164-4811-9ea1-f960c7359c40

Detects remote thread creation from CACTUSTORCH as described in references.

Techniques: T1055.012 T1059.005 T1059.007 T1218.005

TanStack Supply-Chain Attack Execution Indicators - Linux highexperimental

Author: Leonardo Gasparini · 2026-05-12 · logsource: product=linux category=process_creation · 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026. The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.

Techniques: T1059.007 T1059.006 T1204.002

AppLocker Prevented Application or Script from Running mediumtest

Author: Pushkarev Dmitry · 2020-06-28 (modified 2025-12-03) · logsource: product=windows service=applocker · 401e5d00-b944-11ea-8f9a-00163ecd60ae

Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

Techniques: T1204.002 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007

HTML Help HH.EXE Suspicious Child Process hightest

Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Techniques: T1047 T1059.001 T1059.003 T1059.005 T1059.007 T1218 T1218.001 T1218.010 T1218.011 T1566 T1566.001

AppLocker Application Would Have Been Blocked mediumexperimental

Author: heyyanu · 2026-03-26 · logsource: product=windows service=applocker · 557e3bd3-7f21-495d-8d50-7c8bdfb8041c

Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.

Techniques: T1204.002 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007

HackTool - Koadic Execution hightest

Author: wagga, Jonhnathan Ribeiro, oscd.community · 2020-01-12 (modified 2023-02-11) · logsource: product=windows category=process_creation · 5cddf373-ef00-4112-ad72-960ac29bac34

Detects command line parameters used by Koadic hack tool

Techniques: T1059.003 T1059.005 T1059.007

Suspicious Deno File Written from Remote Source lowexperimental

Author: Josh Nickels, Michael Taggart · 2025-05-22 · logsource: product=windows category=file_event · 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e

Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.

Techniques: T1204 T1059.007 T1105

All 29 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
AN0219 Windows
Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList

AN0220 Linux
Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content
auditd:SYSCALL execve → DC0032 Process Creation
NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

Tunable: WebProcList ChildToolList BurstThreshold TimeWindow

AN0221 macOS
Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content
macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation
NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

Tunable: ServiceList TimeWindow

AN0222 Containers
Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content
docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation
NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

Tunable: IngressNamespaces MetadataEndpoints TimeWindow

AN0223 IaaS
Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content
AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

Tunable: LBProjects ErrorBurst

AN0224 ESXi
Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content
NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

Tunable: MgmtCIDR TimeWindow

AN0225 Network Devices
Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content
NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged `attack.t1190` (149)

Potential CVE-2023-25717 Exploitation Attempt hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-30 · logsource: category=webserver · 043c1609-0e32-4462-a6f2-5a0c2da3fafe

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Techniques: T1190

CVE tags: CVE-2023-25717

Potential CVE-2021-27905 Exploitation Attempt mediumtest

Author: @gott_cyber · 2022-12-11 (modified 2023-03-24) · logsource: category=webserver · 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Techniques: T1190

CVE tags: CVE-2021-27905

Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 criticaltest

Author: Florian Roth (Nextron Systems) · 2020-07-10 (modified 2023-01-02) · logsource: category=webserver · 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Techniques: T1190

CVE tags: CVE-2020-8193CVE-2020-8195

Ruby on Rails Framework Exceptions mediumstable

Author: Thomas Patzke · 2017-08-06 (modified 2020-09-01) · logsource: product=ruby_on_rails category=application · 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Techniques: T1190

Potential CVE-2023-23752 Exploitation Attempt hightest

Author: Bhabesh Raj · 2023-02-23 · logsource: category=webserver · 0e1ebc5a-15d0-4bf6-8199-b2535397433a

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Techniques: T1190

CVE tags: CVE-2023-23752

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Terminal Service Process Spawn hightest

Author: Florian Roth (Nextron Systems) · 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Techniques: T1190 T1210

RDS Database Security Group Modification mediumtest

Author: jamesc-grafana · 2024-07-11 · logsource: product=aws service=cloudtrail · 14f3f1c8-02d5-43a2-a191-91ffb52d3015

Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.

Techniques: T1190

Cisco ASA Exploitation Activity - Proxy highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-20 · logsource: category=proxy · 15697955-6a29-47ca-92e9-0e05efae3260

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

Techniques: T1190

CVE tags: CVE-2025-20333CVE-2025-20362

TerraMaster TOS CVE-2020-28188 hightest

Author: Bhabesh Raj · 2021-01-25 (modified 2023-01-02) · logsource: category=webserver · 15c312b9-00d0-4feb-8870-7d940a4bdc5e

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Techniques: T1190

CVE tags: CVE-2020-28188

Potential Server Side Template Injection In Velocity hightest

Author: Moti Harmats · 2023-02-11 · logsource: product=velocity category=application · 16c86189-b556-4ee8-b4c7-7e350a195a4f

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Techniques: T1190

CVE-2021-21972 VSphere Exploitation hightest

Author: Bhabesh Raj · 2021-02-24 (modified 2023-01-02) · logsource: category=webserver · 179ed852-0f9b-4009-93a7-68475910fd86

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

Techniques: T1190

CVE tags: CVE-2021-21972

Potential OWASSRF Exploitation Attempt - Webserver hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-22 (modified 2023-01-02) · logsource: category=webserver · 181f49fa-0b21-4665-a98c-a57025ebb8c7

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Techniques: T1190

Suspicious User-Agents Related To Recon Tools mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton · 2022-07-19 (modified 2026-06-11) · logsource: category=webserver · 19aa4f58-94ca-45ff-bc34-92e533c0994a

Detects known suspicious (default) user-agents related to scanning/recon tools

Techniques: T1190

Python SQL Exceptions mediumstable

Author: Thomas Patzke · 2017-08-12 (modified 2020-09-01) · logsource: product=python category=application · 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9

Generic rule for SQL exceptions in Python according to PEP 249

Techniques: T1190

All 149 rules on the technique page →

T1505.003 Web Shell secondary impact

DET0394 Web Shell Detection via Server Behavior and File Execution Chains
AN1108 Windows
Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)

WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation
NSM:Flow Inbound HTTP POST with suspicious payload size or user-agent → DC0085 Network Traffic Content

Tunable: WebRootPath ParentProcess

AN1109 Linux
File creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx

auditd:SYSCALL new file created in /var/www/html, /srv/http, or similar web root → DC0039 File Creation
auditd:SYSCALL apache2 or nginx spawning sh, bash, or python interpreter → DC0032 Process Creation
NSM:Flow POST requests to .php, .jsp, .aspx files with high entropy body → DC0085 Network Traffic Content

Tunable: WebRootPath PayloadEntropyThreshold TimeWindow

AN1110 macOS
Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www

macos:unifiedlog httpd spawning bash, zsh, python, or osascript → DC0032 Process Creation
auditd:SYSCALL file write operations in /Library/WebServer/Documents → DC0061 File Modification

Tunable: InterpreterName ExecutionParent

Sigma rules tagged `attack.t1505.003` (35)

Suspicious File Write to SharePoint Layouts Directory highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-07-24 · logsource: product=windows category=file_event · 1f0489be-b496-4ddf-b3a9-5900f2044e9c

Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.

Techniques: T1190 T1505.003

Suspicious Process Spawned by CentreStack Portal AppPool highexperimental

Author: Jason Rathbun (Blackpoint Cyber) · 2025-04-17 · logsource: product=windows category=process_creation · 2d79e371-2a27-42de-87a4-b4213fc72a6a

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

Techniques: T1059.003 T1505.003

CVE tags: CVE-2025-30406

Webshell ReGeorg Detection Via Web Logs hightest

Author: Cian Heasley · 2020-08-04 (modified 2023-01-02) · logsource: category=webserver · 2ea44a60-cfda-11ea-87d0-0242ac130003

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

Techniques: T1505.003

Execution From Webserver Root Folder mediumtest

Author: Florian Roth (Nextron Systems) · 2019-01-16 (modified 2024-01-18) · logsource: product=windows category=process_creation · 35efb964-e6a5-47ad-bbcd-19661854018d

Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors

Techniques: T1505.003

Oracle WebLogic Exploit criticaltest

Author: Florian Roth (Nextron Systems) · 2018-07-22 (modified 2023-01-02) · logsource: category=webserver · 37e8369b-43bb-4bf8-83b6-6dd43bda2000

Detects access to a webshell dropped into a keystore folder on the WebLogic server

Techniques: T1190 T1505.003

CVE tags: CVE-2018-2894

Potential Webshell Creation On Static Website mediumtest

Author: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo · 2019-10-22 (modified 2023-10-15) · logsource: product=windows category=file_event · 39f1f9f2-9636-45de-98f6-a4046aa8e4b9

Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.

Techniques: T1505.003

MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-03 (modified 2023-07-28) · logsource: category=webserver · 435e41f2-48eb-4c95-8a2b-ed24b50ec30b

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

Techniques: T1505.003

CVE tags: CVE-2023-34362

Webshell Hacking Activity Patterns hightest

Author: Florian Roth (Nextron Systems) · 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Techniques: T1505.003 T1018 T1033 T1087

Mailbox Export to Exchange Webserver criticaltest

Author: Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems) · 2021-08-09 (modified 2023-04-30) · logsource: product=windows service=msexchange-management · 516376b4-05cd-4122-bae0-ad7641c38d48

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

Techniques: T1505.003

Potential Java WebShell Upload in SAP NetViewer Server highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-05-14 · logsource: category=webserver · 639b893f-f93a-4e53-a7c8-f08cf73fe7f7

Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.

Techniques: T1505.003

CVE tags: CVE-2025-31324

Suspicious File Drop by Exchange mediumtest

Author: Florian Roth (Nextron Systems) · 2022-10-04 · logsource: product=windows category=file_event · 6b269392-9eba-40b5-acb6-55c882b20ba6

Detects suspicious file type dropped by an Exchange component in IIS

Techniques: T1190 T1505.003

Suspicious MSExchangeMailboxReplication ASPX Write hightest

Author: Florian Roth (Nextron Systems) · 2022-02-25 · logsource: product=windows category=file_event · 7280c9f3-a5af-45d0-916a-bc01cb4151c9

Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation

Techniques: T1190 T1505.003

Windows Webshell Strings hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2017-02-19 (modified 2022-11-18) · logsource: category=webserver · 7ff9db12-1b94-4a79-ba68-a2402c5d6729

Detects common commands used in Windows webshells

Techniques: T1505.003

Linux Webshell Indicators hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-10-15 (modified 2026-08-19) · logsource: product=linux category=process_creation · 818f7b24-0fba-4c49-a073-8b755573b9c7

Detects suspicious sub processes of web server processes

Techniques: T1505.003

Suspicious Process By Web Server Process hightest

Author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) · 2019-01-16 (modified 2024-11-26) · logsource: product=windows category=process_creation · 8202070f-edeb-4d31-a010-a26c72ac5600

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Techniques: T1505.003 T1190

All 35 rules on the technique page →

CVE-2022-22963 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059.007 JavaScript primary impact

Sigma rules tagged attack.t1059.007 (29)

T1190 Exploit Public-Facing Application exploitation technique

Sigma rules tagged attack.t1190 (149)

T1505.003 Web Shell secondary impact

Sigma rules tagged attack.t1505.003 (35)

Sigma rules tagged `attack.t1059.007` (29)

Sigma rules tagged `attack.t1190` (149)

Sigma rules tagged `attack.t1505.003` (35)