Coverage › CVE-2024-11120
CVE-2024-11120 Mapped Sigma
GeoVision Devices OS Command Injection Vulnerability
- Vendor / product
- GeoVision — Multiple Devices
- Description (CISA)
- Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- Added to KEV
- 2025-05-07
- Due date
- 2025-05-28
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known ransomware use
- Unknown
- CWE
- CWE-78
- CISA notes
- https://dlcdn.geovision.com.tw/TechNotice/CyberSecurity/Security_Advisory_IP_Device_2024-11.pdf
https://nvd.nist.gov/vuln/detail/CVE-2024-11120 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1133 External Remote Services | exploitation technique | Specific end-of-life GeoVision IoT devices contain an insufficient input validation vulnerability that allows for unauthenticated attackers to inject arbitrary commands and execute them on the system. ref 1 |
live |
| T1203 Exploitation for Client Execution | exploitation technique | Specific end-of-life GeoVision IoT devices contain an insufficient input validation vulnerability that allows for unauthenticated attackers to inject arbitrary commands and execute them on the system. ref 1 |
live |
| T1498 Network Denial of Service | primary impact | Specific end-of-life GeoVision IoT devices contain an insufficient input validation vulnerability that allows for unauthenticated attackers to inject arbitrary commands and execute them on the system. This leads to denial of service. ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1133 External Remote Services exploitation technique
- DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
AN1004 WindowsUnusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.WinEventLog:Application
VPN, Citrix, or remote access gateway logs showing external IP addresses→ DC0038 Application Log ContentTunable:BusinessHoursKnownRemoteIPsFailedLogonThresholdGeoIPWhitelistTimeWindowAN1005 LinuxRepeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).Tunable:KnownSSHClientsFailedLogonThresholdTimeWindowAN1006 macOSUnexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.macos:unifiedlogRemote login (ssh) or screen sharing authentication attempts→ DC0088 Logon Session MetadataTunable:KnownVNCServersTimeWindowAN1007 ContainersConnections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.ApplicationLog:APIDocker/Kubernetes API access from external sources→ DC0038 Application Log Contentkubernetes:auditUnauthorized container creation or kubelet exec logs→ DC0088 Logon Session MetadataTunable:AllowedCIDRsTimeWindow
Sigma rules tagged attack.t1133 (20)
Author: Josh Nickels, Qi Nan
· 2024-03-11 · logsource: product=linux category=process_creation · 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
· 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2
Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2025-11-01 · logsource: product=fortigate service=event · 2bfb6216-0c31-4d20-8501-2629b29a3fa2
Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.
This behavior was observed in pair with modification of VPN SSL settings.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 512cff7a-683a-43ad-afe0-dd398e872f36
Detects instances where a Telnet service on an OpenCanary node has had a login attempt.
Author: Marco Pedrinazzi (@pedrinazziM)
· 2026-01-06 · logsource: product=opencanary category=application · 598290cf-5932-45cd-9123-be1e05ab4f2e
Detects instances where an RDP service on an OpenCanary node has had a connection attempt.
Author: MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-07 · logsource: product=windows category=process_creation · 6c76b3d0-afe4-4870-9443-ffe6773c5fef
Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035.
This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
Author: Florian Roth (Nextron Systems)
· 2021-02-11 (modified 2024-02-26) · logsource: product=windows category=process_creation · 75bfe6e6-cd8e-429e-91d3-03921e1d7962
Detects ScreenConnect program starts that establish a remote access to a system.
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
· 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 78d5cab4-557e-454f-9fb9-a222bd0d5edc
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2025-11-01 · logsource: product=fortigate service=event · 8b5dacf2-aeb7-459d-b133-678eb696d410
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
Author: Tim Rauch (Nextron Systems), Elastic (idea)
· 2022-09-27 (modified 2023-02-15) · logsource: product=windows category=file_delete · 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0
Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Author: Tim Rauch (Nextron Systems), Elastic (idea)
· 2022-09-27 · logsource: product=windows category=file_change · 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3
Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Author: Tim Rauch, Elastic (idea)
· 2022-09-27 (modified 2023-02-05) · logsource: product=windows category=process_creation · a4e3d776-f12e-42c2-8510-9e6ed1f43ec3
Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)
Author: Josh Nickels, Qi Nan
· 2024-03-11 · logsource: product=windows category=process_creation · ab70c354-d9ac-4e11-bbb6-ec8e3b153357
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Author: frack113
· 2021-12-28 (modified 2023-08-17) · logsource: product=windows category=registry_set · b64a026b-8deb-4c1d-92fd-98893209dff1
Running Chrome VPN Extensions via the Registry install 2 vpn extension
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d
Detects instances where an SSH service on an OpenCanary node has had a connection attempt.
All 20 rules on the technique page →
T1203 Exploitation for Client Execution exploitation technique
- DET0287 Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps)
AN0797 WindowsCause→effect chain: (1) A client app (browser, Office, PDF/Flash/reader) experiences a crash/abnormal exit or loads from an unusual location, then (2) drops or modifies a file in user-writable paths, and/or (3) spawns an unexpected child (e.g., powershell/cmd/mshta/rundll32/wscript/installer), and (4) establishes outbound C2-like connections shortly after. Correlate application logs, file writes, process lineage, and network egress within a short window.Tunable:
TimeWindowHighRiskChildrenUserPathsAllowedPluginsEgressAllowlistAN0798 LinuxCause→effect chain: (1) Browser/Office/reader process logs crash/segfault or abnormal sandbox message, (2) new executable/script/write occurs in $HOME (Downloads, ~/.cache, /tmp), (3) unexpected child like curl/wget/bash/python opens network connections soon after.Tunable:TimeWindowUserPathsHighRiskChildrenPackageUpdatersAN0799 macOSCause→effect chain: (1) App crash/abnormal termination in unified logs for Safari/Chrome/Office/Preview, (2) new files/scripts in ~/Library, ~/Downloads, /private/var/folders/*, (3) unexpected child (osascript, zsh, bash, curl) spawned by those apps, (4) new outbound connections.Tunable:TimeWindowHighRiskChildrenUserPathsQuarantineBypass
Sigma rules tagged attack.t1203 (35)
Author: Florian Roth (Nextron Systems)
· 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19
Detects download of certain file types from hosts in suspicious TLDs
Author: Florian Roth (Nextron Systems)
· 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Arnim Rupp (Nextron Systems)
· 2026-06-15 · logsource: category=antivirus · 101a1877-2cf4-474d-abfd-7f6ac4788d1a
Detects a highly relevant Antivirus alert that reports APT malware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-31 · logsource: product=windows category=process_creation · 146aace8-9bd6-42ba-be7a-0070d8027b76
Detects potentially suspicious child processes of WinRAR.exe.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
· 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 238527ad-3c2c-4e4f-a1f6-92fd63adb864
Detects a highly relevant Antivirus alert that reports an exploitation framework.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Author: Florian Roth
· 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Author: Sittikorn S, frack113
· 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-12 (modified 2024-03-12) · logsource: product=windows category=network_connection · 3c21219b-49b5-4268-bce6-c914ed50f09c
Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-20 · logsource: category=webserver · 41956f7c-7a6b-46d6-b6bb-da6eb2e83fbe
Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0.
CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass,
which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through
template injection. This sequence enables unauthenticated remote code execution, significantly increasing
the impact of exploitation.
Author: Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-31 · logsource: product=windows category=process_creation · 43259cc4-1b80-4931-bd98-baea01afc196
Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe.
This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-12 (modified 2024-01-31) · logsource: product=windows category=network_connection · 4c5fba4a-9ef6-4f16-823d-606246054741
Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 5299fadf-f228-4526-8274-251db1960be9
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack.
The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.
All 35 rules on the technique page →
T1498 Network Denial of Service primary impact
- DET0518 Behavioral Detection of T1498 – Network Denial of Service Across Platforms
AN1434 WindowsExecutable or script generating large outbound network traffic targeting remote hosts or known amplification portsTunable:
ThresholdEventVolumeDestinationDiversityAN1435 LinuxFlooding tools like hping3 or nping sending large volumes of packets across multiple ports or IPsauditd:SYSCALLExecution of network stress tools or anomalies in socket/syscall behavior→ DC0032 Process CreationNSM:FlowHigh volume flows with incomplete TCP sessions or single-packet bursts→ DC0078 Network Traffic FlowTunable:PacketRateThreshold
Sigma rules tagged attack.t1498 (3)
Author: Leo Tsaousis (@laripping)
· 2024-03-26 · logsource: product=kubernetes category=application service=audit · 40967487-139b-4811-81d9-c9767a92aa5a
Detects the removal of a deployment from a Kubernetes cluster.
This could indicate disruptive activity aiming to impact business operations.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 7cded4b3-f09e-405a-b96f-24248433ba44
Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.
Author: Florian Roth (Nextron Systems)
· 2022-02-25 (modified 2023-02-08) · logsource: product=windows category=process_creation · 999e8307-a775-4d5f-addc-4855632335be
Detects command line patterns used by BlackByte ransomware in different operations