Coverage › CVE-2025-0282

CVE-2025-0282 Mapped Sigma

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Vendor / product

Ivanti — Connect Secure, Policy Secure, and ZTA Gateways

Description (CISA)

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.

Added to KEV

2025-01-08

Due date

2025-01-15

Required action

Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.

Known ransomware use

Known

CWE

CWE-121

CISA notes

CISA Mitigation Instructions: https://www.cisa.gov/cisa-mitigation-instructions-CVE-2025-0282 Additional References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283
https://nvd.nist.gov/vuln/detail/CVE-2025-0282

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

6 mapping objects across 6 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1003 OS Credential Dumping primary impact

• DET0234 Credential Dumping via Sensitive Memory and Registry Access Correlation
  AN0648 Windows

  Processes accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

  WinEventLog:Security EventCode=4662 → DC0071 Active Directory Object Access

  Tunable: AccessMask TimeWindow ParentProcessFilter
  AN0649 Linux

  Processes opening /proc//mem or /proc//maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.

  auditd:SYSCALL open → DC0055 File Access

  auditd:SYSCALL ptrace → DC0035 Process Access

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: TargetProcessName ToolProcessName
  AN0650 macOS

  Unsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.

  macos:unifiedlog Code Execution & Entitlement Access → DC0034 Process Metadata

  macos:keychain Access to Keychain DB or system.keychain → DC0055 File Access

  macos:osquery Invocation of osascript or dylib injection → DC0032 Process Creation

  Tunable: KeychainAccessPath SignedBinaryStatus

Sigma rules tagged attack.t1003 (37)

All 37 rules on the technique page →

T1018 Remote System Discovery secondary impact

• DET0574 Detection Strategy for Remote System Enumeration Behavior
  AN1583 Windows

  Execution of network enumeration utilities (e.g., net.exe, ping.exe, tracert.exe) in short succession, often chained with lateral movement tools or system enumeration commands.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: TimeWindow CommandLinePattern ParentProcess
  AN1584 Linux

  Use of bash scripts or interactive shells to issue sequential ping, arp, or traceroute commands to map remote hosts.

  auditd:EXECVE execve → DC0032 Process Creation

  linux:syslog network → DC0082 Network Connection Creation

  Tunable: TargetIPRange ShellContext
  AN1585 macOS

  Execution of built-in or AppleScript-based system enumeration via arp, netstat, ping, and discovery of /etc/hosts contents.

  macos:unifiedlog process → DC0032 Process Creation

  macos:osquery file_events → DC0055 File Access

  Tunable: ExecutionUser CommandSignature
  AN1586 ESXi

  ESXi shell or SSH access issuing esxcli network diag ping or viewing routing tables to identify connected hosts.

  esxi:hostd None → DC0064 Command Execution

  Tunable: ESXCommandPattern RemoteUserShell
  AN1587 Network Devices

  Execution of discovery commands like show cdp neighbors, show arp, and other interface-level introspection on Cisco or Juniper devices.

  networkdevice:syslog syslog facility LOCAL7 or trap messages → DC0064 Command Execution

  Tunable: CommandList PrivLevel

Sigma rules tagged attack.t1018 (17)

All 17 rules on the technique page →

T1046 Network Service Discovery secondary impact

• DET0376 Behavioral Detection Strategy for Network Service Discovery Across Platforms
  AN1057 Windows

  Detects processes performing network enumeration (e.g., port scans, service probing) by correlating process creation, socket connections, and sequential destination IP probing within a time window.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: ScanRateThreshold KnownScannerExeList TimeWindow
  AN1058 Linux

  Detects use of network scanning utilities or scripts performing rapid connections to multiple services or hosts using auditd and netflow/pcap telemetry.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow Outbound TCP SYN or UDP to multiple ports/hosts → DC0078 Network Traffic Flow

  Tunable: PortScanThreshold ToolPatternRegex ExpectedScanSources
  AN1059 macOS

  Detects Bonjour-based mDNS enumeration or use of system tools (e.g., dns-sd, nmap) to find active services via multicast probing or targeted scans.

  macos:unifiedlog dns-sd, mDNSResponder, socket activity → DC0085 Network Traffic Content

  macos:osquery process_events → DC0032 Process Creation

  Tunable: MDNSServiceQueryPatterns UserContext ScanToolList
  AN1060 Containers

  Detects lateral discovery or container breakout attempts using netcat, curl, or custom binaries probing other services within the same namespace or VPC subnet.

  ebpf:syscalls socket connect → DC0082 Network Connection Creation

  ebpf:syscalls execve → DC0032 Process Creation

  containerd:runtime container-level outbound traffic events → DC0078 Network Traffic Flow

  Tunable: ExecutablePath TimeWindow NetworkDestinationCount

Sigma rules tagged attack.t1046 (20)

All 20 rules on the technique page →

T1055 Process Injection primary impact

• DET0508 Behavioral Detection of Process Injection Across Platforms
  AN1399 Windows

  Detects process injection by correlating memory manipulation API calls (e.g., VirtualAllocEx, WriteProcessMemory), suspicious thread creation (e.g., CreateRemoteThread), and unusual DLL loads within another process's context.

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  etw:Microsoft-Windows-Kernel-Process API calls → DC0021 OS API Execution

  Tunable: AccessMask TimeWindow InjectedProcessList
  AN1400 Linux

  Detects ptrace- or memfd-based process injection through audit logs capturing system calls (e.g., ptrace, mmap) targeting running processes along with suspicious file descriptors or memory writes.

  auditd:SYSCALL ptrace, mmap, process_vm_writev → DC0021 OS API Execution

  auditd:SYSCALL open → DC0055 File Access

  linux:procfs /proc/[pid]/maps, /proc/[pid]/mem → DC0020 Process Modification

  Tunable: TargetPIDThreshold TimeWindow
  AN1401 macOS

  Detects memory-based injection by monitoring task_for_pid, mach_vm_write, and dylib injection patterns through DYLD_INSERT_LIBRARIES or manual memory mapping.

  macos:unifiedlog subsystem=com.apple.security, library=libsystem_kernel.dylib → DC0035 Process Access

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP → DC0034 Process Metadata

  macos:syslog DYLD_INSERT_LIBRARIES anomalies → DC0016 Module Load

  Tunable: TargetProcessSignature MachSyscallContext

Sigma rules tagged attack.t1055 (37)

All 37 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

• DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
  AN0219 Windows

  Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

  ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList
  AN0220 Linux

  Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

  ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

  Tunable: WebProcList ChildToolList BurstThreshold TimeWindow
  AN0221 macOS

  Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

  macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content

  macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation

  NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

  Tunable: ServiceList TimeWindow
  AN0222 Containers

  Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

  ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content

  docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation

  NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

  Tunable: IngressNamespaces MetadataEndpoints TimeWindow
  AN0223 IaaS

  Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

  ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content

  AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

  Tunable: LBProjects ErrorBurst
  AN0224 ESXi

  Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

  esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content

  NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

  Tunable: MgmtCIDR TimeWindow
  AN0225 Network Devices

  Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

  networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content

  NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

  Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged attack.t1190 (149)

All 149 rules on the technique page →

T1595 Active Scanning exploitation technique

• DET0830 Detection of Active Scanning
  AN1962 PRE

  Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).

  Network Traffic None → DC0078 Network Traffic Flow

  Network Traffic None → DC0085 Network Traffic Content

Sigma rules tagged attack.t1595 (3)