Coverage › CVE-2013-0640
CVE-2013-0640 Mapped Sigma
Adobe Reader and Acrobat Memory Corruption Vulnerability
- Vendor / product
- Adobe — Reader and Acrobat
- Description (CISA)
- An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.
- Added to KEV
- 2022-03-03
- Due date
- 2022-03-24
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Unknown
- CWE
- CWE-787
- CISA notes
- https://nvd.nist.gov/vuln/detail/CVE-2013-0640
- Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
1 mapping object across 1 technique. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1566.001 Spearphishing Attachment | exploitation technique | This vulnerability is exploited via a maliciously-crafted pdf delivered as an email attachment. ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1566.001 Spearphishing Attachment exploitation technique
- DET0236 Detection Strategy for Spearphishing Attachment across OS Platforms
AN0655 WindowsDetection of spearphishing attachments by correlating suspicious email delivery with subsequent file creation and abnormal process execution (e.g., Office spawning PowerShell or CMD). Behavior chain includes inbound email metadata → attachment stored on disk → process execution → outbound network activity.m365:unified
Send/Receive: Inbound emails with attachments from suspicious or spoofed senders→ DC0038 Application Log ContentTunable:AttachmentExtensionsSuspiciousParentChildPairsTimeWindowAN0656 LinuxPhishing attachments executed on Linux systems are detected by linking email logs to file creation in mail directories and subsequent suspicious process execution. Look for unexpected binaries or scripts spawned from user mail directories and anomalous outbound network activity.Application:MailInbound email attachments logged from MTAs with suspicious metadata→ DC0038 Application Log Contentauditd:SYSCALLexecve: Execution of files saved in mail or download directories→ DC0032 Process CreationNSM:FlowOutbound traffic from suspicious new processes post-attachment execution→ DC0078 Network Traffic FlowTunable:AttachmentStoragePathsScriptInterpretersAN0657 macOSPhishing attachment detection on macOS through correlation of Mail app logs, file creation in user directories, and abnormal process execution (e.g., Preview.app or Mail.app spawning Terminal or scripting binaries). Network traffic after attachment interaction is also monitored.macos:unifiedlogInbound messages with attachments from suspicious domains→ DC0038 Application Log Contentmacos:unifiedlogExecution of Terminal, osascript, or other interpreters originating from Mail or Preview→ DC0032 Process Creationmacos:unifiedlogAttachment files written to ~/Downloads or temporary folders→ DC0039 File CreationTunable:ExecutionDelayThresholdSuspiciousParentApps
Sigma rules tagged attack.t1566.001 (24)
Author: Florian Roth (Nextron Systems)
· 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Author: Syed Hasan (@syedhasan009)
· 2021-05-29 (modified 2023-11-09) · logsource: product=windows service=security · 0248a7bc-8a9a-4cd8-a57e-3ae8e073a073
Detects the mount of an ISO image on an endpoint
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-01-23 (modified 2025-10-29) · logsource: product=windows category=file_event · 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66
Detects the creation of a new office macro files on the system via an application (browser, mail client).
This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation.
Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems)
· 2019-06-26 (modified 2025-05-30) · logsource: product=windows category=process_creation · 1cdd9a09-06c9-4769-99ff-626e2b3991b8
Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns
Author: Sreeman
· 2020-03-13 (modified 2022-04-14) · logsource: product=windows category=process_creation · 24de4f3b-804c-4165-b442-5a06a2302c7e
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.
Author: Antonlovesdnb, Trent Liffick (@tliffick)
· 2020-02-19 (modified 2023-06-21) · logsource: product=windows category=registry_event · 295a59c1-7b79-4b47-a930-df12c15fc9c2
Alerts on trust record modification within the registry, indicating usage of macros
Author: @sam0x90
· 2022-07-30 · logsource: product=windows category=file_event · 2f9356ae-bf43-41b8-b858-4496d83b2acb
Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2026-01-27 · logsource: product=m365 service=audit · 3569aefd-e535-4391-8c18-24bd01a21eaf
Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder.
It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.
Author: Florian Roth (Nextron Systems)
· 2022-02-11 · logsource: product=windows category=file_event · 4358e5a5-7542-4dcb-b9f3-87667371839b
Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks.
This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.
Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Author: Joseph Kamau
· 2025-12-05 · logsource: product=windows category=process_creation · 538c5851-8c03-4724-8ec4-623bc7aadaea
Detects web browser process opening an HTML file from a user's Downloads folder.
This behavior is could be associated with phishing attacks where threat actors send HTML attachments to users.
When a user opens such an attachment, it can lead to the execution of malicious scripts or the download of malware.
During investigation, analyze the HTML file for embedded scripts or links, check for any subsequent downloads or process executions, and investigate the source of the email or message containing the attachment.
Author: Florian Roth (Nextron Systems)
· 2022-05-09 · logsource: product=windows service=security · 571498c8-908e-40b4-910b-d2369159a3da
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
Author: Florian Roth (Nextron Systems)
· 2017-11-23 (modified 2021-11-27) · logsource: product=windows category=process_creation · 678eb5f4-8597-4be6-8be7-905e4234b53a
Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe
Author: Florian Roth (Nextron Systems)
· 2018-02-22 (modified 2021-11-27) · logsource: product=windows category=process_creation · 864403a1-36c9-40a2-a982-4c9a45f7d833
Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-01-23 (modified 2026-01-09) · logsource: product=windows category=file_event · 91174a41-dc8f-401b-be89-7bfc140612a0
Detects the creation of a new office macro files on the systems