Coverage › CVE-2024-23692

CVE-2024-23692 Mapped Sigma

Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Vendor / product: Rejetto — HTTP File Server
Description (CISA): Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.
Added to KEV: 2024-07-09
Due date: 2024-07-30
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Known
CWE: CWE-1336
CISA notes: The patched Rejetto HTTP File Server (HFS) is version 3: https://github.com/rejetto/hfs?tab=readme-ov-file#installation, https://www.rejetto.com/hfs/
https://nvd.nist.gov/vuln/detail/CVE-2024-23692
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

5 mapping objects across 5 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1221 Template Injection	exploitation technique	CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data. ref 1 · ref 2 · ref 3 · ref 4	live
T1005 Data from Local System	secondary impact	CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data. ref 1 · ref 2 · ref 3 · ref 4	live
T1082 System Information Discovery	primary impact	CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data. ref 1 · ref 2 · ref 3 · ref 4	live
T1105 Ingress Tool Transfer	secondary impact	CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data. ref 1 · ref 2 · ref 3 · ref 4	live
T1496 Resource Hijacking	secondary impact	CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data. ref 1 · ref 2 · ref 3 · ref 4	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1005 Data from Local System secondary impact

DET0380 Detection of Local Data Collection Prior to Exfiltration
AN1070 Windows
Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

Tunable: TargetFilePathRegex ParentProcessFilter

AN1071 Linux
Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.

auditd:SYSCALL open → DC0055 File Access
auditd:SYSCALL execve → DC0032 Process Creation

Tunable: TimeWindow ScriptToolName

AN1072 macOS
Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.

macos:unifiedlog process:spawn → DC0032 Process Creation
fs:fsusage read/write → DC0055 File Access

Tunable: UserContext TargetVolume

AN1073 Network Devices
Collection of device configuration via CLI commands (e.g., show running-config, copy flash, more), often followed by TFTP/SCP transfers.

networkdevice:cli command logging → DC0064 Command Execution

Tunable: CommandScope AuthenticatedUserList

AN1074 ESXi
Adversaries accessing datastore or configuration files via vim-cmd, esxcli, or SCP to extract logs, VMs, or host configurations.

esxis:vmkernel Datastore Access → DC0055 File Access
esxi:hostd Command Execution → DC0064 Command Execution

Tunable: AccessPathRegex InteractiveShellUsage

Sigma rules tagged `attack.t1005` (14)

Script Interpreter Spawning Credential Scanner - Windows highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

ADFS Database Named Pipe Connection By Uncommon Tool mediumtest

Author: Roberto Rodriguez @Cyb3rWard0g · 2021-10-08 (modified 2023-11-30) · logsource: product=windows category=pipe_created · 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3

Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.

Techniques: T1005

OpenCanary - SMB File Open Request hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 22777c9e-873a-4b49-855f-6072ab861a52

Detects instances where an SMB service on an OpenCanary node has had a file open request.

Techniques: T1021 T1005

SQLite Chromium Profile Data DB Access hightest

Author: TropChaud · 2022-12-19 (modified 2023-01-19) · logsource: product=windows category=process_creation · 24c77512-782b-448a-8950-eddb0785fc71

Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.

Techniques: T1539 T1555.003 T1005

Potential Conti Ransomware Database Dumping Activity Via SQLCmd hightest

Author: frack113 · 2021-08-16 (modified 2023-05-04) · logsource: product=windows category=process_creation · 2f47f1fd-0901-466e-a770-3b7092834a1b

Detects a command used by conti to dump database

Techniques: T1005

SQLite Firefox Profile Data DB Access hightest

Author: frack113 · 2022-04-08 (modified 2023-01-19) · logsource: product=windows category=process_creation · 4833155a-4053-4c9c-a997-777fcea0baa7

Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.

Techniques: T1539 T1005

AWS EC2 VM Export Failure lowtest

Author: Diogo Braz · 2020-04-16 (modified 2022-10-05) · logsource: product=aws service=cloudtrail · 54b9a76a-3c71-4673-b4b3-2edb4566ea7b

An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.

Techniques: T1005 T1537

Veeam Backup Database Suspicious Query mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-04 · logsource: product=windows category=process_creation · 696bfb54-227e-4602-ac5b-30d9d2053312

Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.

Techniques: T1005

Esentutl Steals Browser Information mediumtest

Author: frack113 · 2022-02-13 (modified 2024-03-05) · logsource: product=windows category=process_creation · 6a69f62d-ce75-4b57-8dce-6351eb55b362

One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

Techniques: T1005

Crash Dump Created By Operating System mediumexperimental

Author: Jason Mull · 2025-05-12 · logsource: product=windows service=system · 882fbe50-d8d7-4e29-ae80-0648a8556866

Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.

Techniques: T1003.002 T1005

VeeamBackup Database Credentials Dump Via Sqlcmd.EXE hightest

Author: frack113 · 2021-12-20 (modified 2023-02-13) · logsource: product=windows category=process_creation · b57ba453-b384-4ab9-9f40-1038086b4e53

Detects dump of credentials in VeeamBackup dbo

Techniques: T1005

Cisco Collect Data lowtest

Author: Austin Clark · 2019-08-11 (modified 2023-01-04) · logsource: product=cisco service=aaa · cd072b25-a418-4f98-8ebc-5093fb38fe1a

Collect pertinent data from the configuration files

Techniques: T1087.001 T1552.001 T1005

Shai-Hulud NPM Package Malicious Exfiltration via Curl highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-09-24 · logsource: product=linux category=process_creation · efd2eb09-b72e-4a61-8dc7-b1382a1e8983

Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.

Techniques: T1041 T1005

Script Interpreter Spawning Credential Scanner - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=linux category=process_creation · f0025a69-e1b7-4dda-a53c-db21fa2d4071

Techniques: T1552 T1005 T1059.004

T1082 System Information Discovery primary impact

DET0525 System Discovery via Native and Remote Utilities
AN1452 Windows
Detection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

Tunable: TimeWindow UserContext

AN1453 Linux
Execution of system enumeration commands such as uname, df, uptime, hostname, lscpu, and cat /etc/os-release through local terminal or scripts.

auditd:SYSCALL execve → DC0032 Process Creation

Tunable: CommandList TerminalSessionID

AN1454 macOS
Execution of system info utilities like systemsetup, sw_vers, uname, or sysctl by terminal or scripted processes.

macos:unifiedlog log show --predicate 'process == <utility>' → DC0064 Command Execution

Tunable: ParentProcess FrequencyThreshold

AN1455 ESXi
Execution of esxcli system hostname get, esxcli system version get, or esxcli hardware commands through SSH or local shell.

esxi:vmkernel /var/log/vmkernel.log → DC0064 Command Execution

Tunable: SessionOrigin CommandString

AN1456 IaaS
Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.

AWS:CloudTrail DescribeInstances, GetConsoleOutput, DescribeImages → DC0075 Instance Enumeration

Tunable: IAMRoleContext APIFrequency

AN1457 Network Devices
Execution of show version, show hardware, or show system commands through CLI via SSH or console.

networkdevice:syslog Privilege-level command execution → DC0064 Command Execution

Tunable: Username CommandList

Sigma rules tagged `attack.t1082` (33)

System Information Discovery via Registry Queries lowexperimental

Author: lazarg · 2025-06-12 (modified 2025-10-25) · logsource: product=windows category=process_creation · 0022869c-49f7-4ff2-ba03-85ac42ddac58

Detects attempts to query system information directly from the Windows Registry.

Techniques: T1082

Suspicious Execution of Systeminfo lowtest

Author: frack113 · 2022-01-01 (modified 2022-07-14) · logsource: product=windows category=process_creation · 0ef56343-059e-4cb6-adc1-4c3c967c5e46

Detects usage of the "systeminfo" command to retrieve information

Techniques: T1082

Docker Container Discovery Via Dockerenv Listing lowtest

Author: Seth Hanford · 2023-08-23 · logsource: product=linux category=process_creation · 11701de9-d5a5-44aa-8238-84252f131895

Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery

Techniques: T1082

System and Hardware Information Discovery informationalstable

Author: Ömer Günal, oscd.community · 2020-10-08 (modified 2022-11-26) · logsource: product=linux service=auditd · 1f358e2e-cb63-43c3-b575-dfb072a6814f

Detects system information discovery commands

Techniques: T1082

System Information Discovery Using Ioreg mediumtest

Author: Joseliyo Sanchez, @Joseliyo_Jstnk · 2023-12-20 (modified 2024-01-02) · logsource: product=macos category=process_creation · 2d5e7a8b-f484-4a24-945d-7f0efd52eab0

Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.

Techniques: T1082

System Information Discovery informationalstable

Author: Ömer Günal, oscd.community · 2020-10-08 (modified 2021-09-14) · logsource: product=linux category=process_creation · 42df45e7-e6e9-43b5-8f26-bec5b39cc239

Detects system information discovery commands

Techniques: T1082

Potential Container Discovery Via Inodes Listing lowtest

Author: Seth Hanford · 2023-08-23 (modified 2025-11-24) · logsource: product=linux category=process_creation · 43e26eb5-cd58-48d1-8ce9-a273f5d298d8

Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.

Techniques: T1082

System Information Discovery Using System_Profiler mediumtest

Author: Stephen Lincoln `@slincoln_aiq` (AttackIQ) · 2024-01-02 · logsource: product=macos category=process_creation · 4809c683-059b-4935-879d-36835986f8cf

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

Techniques: T1082 T1497.001

CMD Shell Output Redirect lowtest

Author: frack113 · 2022-01-22 (modified 2024-03-19) · logsource: product=windows category=process_creation · 4f4eaa9f-5ad4-410c-a4be-bc6132b0175a

Detects the use of the redirection character ">" to redirect information on the command line. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.

Techniques: T1082

Bitbucket User Details Export Attempt Detected mediumtest

Author: Muhammad Faisal (@faisalusuf) · 2024-02-25 · logsource: product=bitbucket service=audit · 5259cbf2-0a75-48bf-b57a-c54d6fabaef3

Detects user data export activity.

Techniques: T1213 T1082 T1591.004

PUA - System Informer Execution mediumtest

Author: Florian Roth (Nextron Systems) · 2023-05-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · 5722dff1-4bdd-4949-86ab-fbaf707e767a

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Techniques: T1082 T1564 T1543

System Information Discovery Using sw_vers mediumtest

Author: Joseliyo Sanchez, @Joseliyo_Jstnk · 2023-12-20 · logsource: product=macos category=process_creation · 5de06a6f-673a-4fc0-8d48-bcfe3837b033

Detects the use of "sw_vers" for system information discovery

Techniques: T1082

System Information Discovery Via Sysctl - MacOS mediumtest

Author: Pratinav Chandra · 2024-05-27 · logsource: product=macos category=process_creation · 6ff08e55-ea53-4f27-94a1-eff92e6d9d5c

Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments.

Techniques: T1497.001 T1082

Suspicious Kernel Dump Using Dtrace hightest

Author: Florian Roth (Nextron Systems) · 2021-12-28 · logsource: product=windows category=process_creation · 7124aebe-4cd7-4ccb-8df0-6d6b93c96795

Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1

Techniques: T1082

Container Residence Discovery Via Proc Virtual FS lowtest

Author: Seth Hanford · 2023-08-23 · logsource: product=linux category=process_creation · 746c86fb-ccda-4816-8997-01386263acc4

Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem

Techniques: T1082

All 33 rules on the technique page →

T1105 Ingress Tool Transfer secondary impact

DET0060 Detect Ingress Tool Transfers via Behavioral Chain
AN0165 Windows
Unusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).

WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: ParentProcessName DestinationIPCategory FilePathRegex

AN0166 Linux
Shell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.

auditd:SYSCALL connect, execve, write → DC0064 Command Execution
auditd:SYSCALL file creation/modification → DC0039 File Creation
iptables:LOG TCP connections → DC0078 Network Traffic Flow

Tunable: ToolName DownloadExtension

AN0167 macOS
Process execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.

macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC → DC0032 Process Creation
macos:unifiedlog file write/create → DC0039 File Creation
macos:unifiedlog connection open → DC0082 Network Connection Creation

Tunable: DirectoryTargeted ProcessPath

AN0168 ESXi
Command line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.

esxi:hostd command execution → DC0064 Command Execution
esxi:vmkernel file write → DC0039 File Creation

Tunable: ToolName DatastorePath

AN0169 Network Devices
Network device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.

NSM:Flow connection metadata → DC0078 Network Traffic Flow
snmp:syslog firmware write/log event → DC0039 File Creation

Tunable: PayloadVolumeThreshold ProtocolUsed

Sigma rules tagged `attack.t1105` (87)

Suspicious Curl File Upload - Linux mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) · 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582

Detects a suspicious curl process start the adds a file to a web request

Techniques: T1567 T1105

Potential Data Exfiltration Via Curl.EXE mediumtest

Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update) · 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04

Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration

Techniques: T1567 T1105

Suspicious Download from Office Domain hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-12-27 (modified 2022-08-02) · logsource: product=windows category=process_creation · 00d49ed5-4491-4271-a8db-650a4ef6f8c1

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Techniques: T1105 T1608

Potential COM Objects Download Cradles Usage - Process Creation mediumtest

Author: frack113 · 2022-12-25 · logsource: product=windows category=process_creation · 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf

Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Techniques: T1105

Insensitive Subfolder Search Via Findstr.EXE lowtest

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Techniques: T1218 T1564.004 T1552.001 T1105

Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

Techniques: T1218 T1105

CVE tags: CVE-2025-33053

Local Network Connection Initiated By Script Interpreter mediumtest

Author: frack113 · 2022-08-28 (modified 2024-05-31) · logsource: product=windows category=network_connection · 08249dc0-a28d-4555-8ba5-9255a198e08c

Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.

Techniques: T1105

Axios NPM Compromise Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

Techniques: T1195.002 T1059.006 T1059.004 T1105

Uncommon Network Connection Initiated By Certutil.EXE hightest

Author: frack113, Florian Roth (Nextron Systems) · 2022-09-02 (modified 2024-05-31) · logsource: product=windows category=network_connection · 0dba975d-a193-4ed1-a067-424df57570d1

Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads.

Techniques: T1105

File Download with Headless Browser hightest

Author: Sreeman, Florian Roth (Nextron Systems) · 2022-01-04 (modified 2025-10-07) · logsource: product=windows category=process_creation · 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Techniques: T1105 T1564.003

Potential DLL File Download Via PowerShell Invoke-WebRequest mediumtest

Author: Florian Roth (Nextron Systems), Hieu Tran · 2023-03-13 (modified 2025-07-18) · logsource: product=windows category=process_creation · 0f0450f3-8b47-441e-a31b-15a91dc243e2

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.

Techniques: T1059.001 T1105

Potential In-Memory Download And Compile Of Payloads mediumtest

Author: Sohan G (D4rkCiph3r), Red Canary (idea) · 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

Techniques: T1059.007 T1105

Suspicious File Downloaded From Direct IP Via Certutil.EXE hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829

Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Techniques: T1027 T1105

Suspicious Diantz Download and Compress Into a CAB File mediumtest

Author: frack113 · 2021-11-26 (modified 2022-08-13) · logsource: product=windows category=process_creation · 185d7418-f250-42d0-b72e-0c8b70661e93

Download and compress a remote file and store it in a cab file on local machine.

Techniques: T1105

Download from Suspicious Dyndns Hosts mediumtest

Author: Florian Roth (Nextron Systems) · 2017-11-08 (modified 2023-05-18) · logsource: category=proxy · 195c1119-ef07-4909-bb12-e66f5e07bf3c

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Techniques: T1105 T1568

All 87 rules on the technique page →

T1221 Template Injection exploitation technique

DET0566 Template Injection Detection - Windows
AN1564 Windows
Detection of Office or document viewer processes (e.g., winword.exe) initiating network connections to remote templates or executing scripts due to manipulated template references (e.g., embedded in .docx, .rtf, or .dotm files), followed by suspicious child process creation (e.g., PowerShell).

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: TemplateURLPatterns ParentProcess TimeWindow ChildProcessAnomalyThreshold

Sigma rules tagged `attack.t1221` (2)

Suspicious Set Value of MSDT in Registry (CVE-2022-30190) mediumtest

Author: Sittikorn S · 2020-05-31 (modified 2023-08-17) · logsource: product=windows category=registry_set · 2d9403d5-7927-46b7-8216-37ab7c9ec5e3

Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.

Techniques: T1221

Server Side Template Injection Strings hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-06-14 · logsource: category=webserver · ada3bc4f-f0fd-42b9-ba91-e105e8af7342

Detects SSTI attempts sent via GET requests in access logs

Techniques: T1221

T1496 Resource Hijacking secondary impact

DET0267 Resource Hijacking Detection Strategy
AN0741 Windows
Persistent high CPU utilization combined with suspicious command-line execution (e.g., mining tools or obfuscated scripts) and outbound connections to mining/proxy networks.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
Windows:perfmon High sustained CPU usage by a single process → DC0018 Host Status
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: TimeWindow DestinationIPList ExecutableNamePatterns

AN0742 Linux
Abnormal CPU/memory usage by unauthorized processes with outbound connections to known mining pools or using cron jobs/scripts to maintain persistence.

auditd:SYSCALL execve → DC0032 Process Creation
linux:procfs Sustained high /proc/[pid]/stat usage → DC0018 Host Status
NSM:Flow Outbound traffic to mining pools or proxies → DC0078 Network Traffic Flow

Tunable: ProcessPath CPUThreshold KnownMiningDomains

AN0743 macOS
Background launch agents/daemons with high CPU use and network access to external mining services.

macos:unifiedlog launchctl activity and process creation → DC0032 Process Creation
macos:unifiedlog Persistent outbound traffic to mining domains → DC0085 Network Traffic Content

Tunable: launchdLabel TrafficVolumeThreshold

AN0744 IaaS
Sudden spikes in cloud VM CPU usage with outbound traffic to mining pools and unauthorized instance creation.

AWS:CloudTrail RunInstances → DC0080 Instance Start
AWS:CloudWatch Sustained EC2 CPU usage above normal baseline → DC0018 Host Status
AWS:VPCFlowLogs Outbound flow logs to known mining pools → DC0078 Network Traffic Flow

Tunable: CPUUtilizationThreshold UnusualRegionList

AN0745 Containers
High CPU usage by unauthorized containers running mining binaries or public proxy tools.

containerd:events New container with suspicious image name or high resource usage → DC0032 Process Creation
prometheus:metrics Container CPU/Memory usage exceeding threshold → DC0018 Host Status
container:cni Outbound network traffic to mining proxies → DC0078 Network Traffic Flow

Tunable: ImageName CPUQuotaThreshold

AN0746 SaaS
Abuse of cloud messaging platforms to send mass spam or consume quota-based resources.

m365:unified SendMessage → DC0069 Cloud Service Modification
saas:application High-volume API calls or traffic via messaging or webhook service → DC0038 Application Log Content

Tunable: MessageRateThreshold APIKeyList

Sigma rules tagged `attack.t1496` (13)

Azure Kubernetes Network Policy Change mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 08d6ac24-c927-4469-b3b7-2e422d6e3c43

Identifies when a Azure Kubernetes network policy is modified or deleted.

Techniques: T1485 T1496 T1489

Azure Kubernetes Service Account Modified or Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 12d027c3-b48c-4d9d-8bb6-a732200034b2

Identifies when a service account is modified or deleted.

Techniques: T1531 T1485 T1496 T1489

Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 25cb259b-bbdc-4b87-98b7-90d7c72f8743

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Techniques: T1485 T1496 T1489

Potential Crypto Mining Activity highstable

Author: Florian Roth (Nextron Systems) · 2021-10-26 (modified 2023-02-13) · logsource: product=windows category=process_creation · 66c3b204-9f88-4d0a-a7f7-8a57d521ca55

Detects command line parameters or strings often used by crypto miners

Techniques: T1496

Azure Kubernetes Secret or Config Object Access mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 7ee0b4aa-d8d4-4088-b661-20efdf41a04c

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Techniques: T1485 T1496 T1489

Azure Kubernetes Sensitive Role Access mediumtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 818fee0c-e0ec-4e45-824e-83e4817b0887

Identifies when ClusterRoles/Roles are being modified or deleted.

Techniques: T1485 T1496 T1489

Linux Crypto Mining Indicators hightest

Author: Florian Roth (Nextron Systems) · 2021-10-26 (modified 2022-12-25) · logsource: product=linux category=process_creation · 9069ea3c-b213-4c52-be13-86506a227ab1

Detects command line parameters or strings often used by crypto miners

Techniques: T1496

Azure Container Registry Created or Deleted lowtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 93e0ef48-37c8-49ed-a02c-038aab23628e

Detects when a Container Registry is created or deleted.

Techniques: T1485 T1496 T1489

Azure Kubernetes Cluster Created or Deleted lowtest

Author: Austin Songer @austinsonger · 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 9541f321-7cba-4b43-80fc-fbd1fb922808

Detects when a Azure Kubernetes Cluster is created or deleted.

Techniques: T1485 T1496 T1489

Linux Crypto Mining Pool Connections highstable

Author: Florian Roth (Nextron Systems) · 2021-10-26 · logsource: product=linux category=network_connection · a46c93b7-55ed-4d27-a41b-c259456c4746

Detects process connections to a Monero crypto mining pool

Techniques: T1496

Monero Crypto Coin Mining Pool Lookup highstable

Author: Florian Roth (Nextron Systems) · 2021-10-24 · logsource: category=dns · b593fd50-7335-4682-a36c-4edcb68e4641

Detects suspicious DNS queries to Monero mining pools

Techniques: T1496 T1567

Author: Saw Winn Naung, Azure-Sentinel, @neu5ron · 2021-08-19 (modified 2022-07-07) · logsource: product=zeek service=dns · bf74135c-18e8-4a72-a926-0e4f47888c19

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

Techniques: T1569.002 T1496

Network Communication With Crypto Mining Pool highstable

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-10-26 (modified 2026-07-24) · logsource: product=windows category=network_connection · fa5b1358-b040-4403-9868-15f7d9ab6329

Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.

Techniques: T1496

CVE-2024-23692 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1005 Data from Local System secondary impact

Sigma rules tagged attack.t1005 (14)

T1082 System Information Discovery primary impact

Sigma rules tagged attack.t1082 (33)

T1105 Ingress Tool Transfer secondary impact

Sigma rules tagged attack.t1105 (87)

T1221 Template Injection exploitation technique

Sigma rules tagged attack.t1221 (2)

T1496 Resource Hijacking secondary impact

Sigma rules tagged attack.t1496 (13)

Sigma rules tagged `attack.t1005` (14)

Sigma rules tagged `attack.t1082` (33)

Sigma rules tagged `attack.t1105` (87)

Sigma rules tagged `attack.t1221` (2)

Sigma rules tagged `attack.t1496` (13)