Coverage › CVE-2015-3043

CVE-2015-3043 Mapped Sigma

Adobe Flash Player Memory Corruption Vulnerability

Vendor / product

Adobe — Flash Player

Description (CISA)

A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.

Added to KEV

2022-03-03

Due date

2022-03-24

Required action

The impacted product is end-of-life and should be disconnected if still in use.

Known ransomware use

Unknown

CWE

CWE-787

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2015-3043

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1189 Drive-by Compromise exploitation technique

• DET0176 Drive-by Compromise — Behavior-based, Multi-platform Detection Strategy (T1189)
  AN0498 Windows

  Correlated evidence of anomalous browser/network behavior (suspicious external resource fetches and script injection patterns) followed by atypical child processes, ephemeral execution contexts, memory modification or process injection, and unexpected file drops. Defender sees network requests to previously unseen/suspicious domains or resources + browser process spawning unusual children or loading unsigned modules + file writes or registry changes shortly after those requests.

  WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Application Browser or plugin/application logs showing script errors, plugin enumerations, or unusual extension load events → DC0038 Application Log Content

  etw:Microsoft-Windows-Kernel-Process Memory Modification / Unmapped module load or suspicious RWX allocations in the process space of a browser process → DC0020 Process Modification

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  NSM:Flow http.request: HTTP requests and responses for specific script resources, unexpected content-types (application/octet-stream for script URLs), suspicious referrers, or obfuscated javascript resources → DC0085 Network Traffic Content

  Tunable: TimeWindow KnownGoodDomainsList PayloadEntropyThreshold UserContext
  AN0499 Linux

  Correlated evidence of browser or webview fetches to uncommon domains or mutated JS resources (proxy/NGFW logs + Zeek/HTTP logs) followed by unexpected interpreters or script engines executing (python, ruby, sh) spawned from browser processes or user sessions, rapid on-disk staging in /tmp, and outbound connections that deviate from baseline. Defender sees: uncommon resource fetch → short-lived child process executions from user browser context → file writes in temp directories → anomalous outbound C2-like connections.

  auditd:SYSCALL execve: execve calls where a browser/webview process is parent and child is interpreter (python, sh, ruby) or downloader (curl, wget) → DC0032 Process Creation

  linux:syslog Application or browser logs (webview errors, plugin enumerations) indicating suspicious script evaluation or plugin loads → DC0038 Application Log Content

  NSM:Flow http::response: HTTP responses with suspicious content-type for scripts, long obfuscated javascript bodies, or redirects to exploit kit domains → DC0085 Network Traffic Content

  linux:Sysmon New files in /tmp, /var/tmp, $HOME/.cache, executed within TimeWindow after browser HTTP fetch → DC0039 File Creation

  NSM:Connections Outbound connections from newly spawned child processes or from the browser to uncommon endpoints or on anomalous ports → DC0082 Network Connection Creation

  Tunable: TempPathPatterns UserShellWhitelist DomainRarityThreshold
  AN0500 macOS

  Correlated evidence where Safari/Chrome/WebKit-based processes issue network requests for uncommon or obfuscated JS resources followed by spawning of script interpreters, launchd or ad-hoc binaries, unusual child processes, or dynamic library loads into browser processes. Defender sees: proxy/HTTP logs with suspicious resource content + unifiedlogs/ASL showing browser/plugin crashes or extension loads + process events indicating child process creation and file writes to /var/folders or /tmp shortly after the fetch.

  macos:unifiedlog Logs from unifiedlogging that show browser crashes, plugin enumerations, extension installs or errors around the same time as suspicious network fetches → DC0038 Application Log Content

  macos:unifiedlog process_create: Process creation where parent is Safari/Google Chrome and child is script interpreter or signed-but-unusual helper binary → DC0032 Process Creation

  macos:unifiedlog New files written to /var/folders, /tmp, ~/Library/Caches, or ~/Downloads by browser context or its children → DC0039 File Creation

  NSM:Flow HTTP/HTTPS requests for script resources flagged by content inspection (excessive obfuscation, eval usage, unusual redirects) → DC0085 Network Traffic Content

  macos:unifiedlog Anomalous dyld dynamic library loads or RWX memory mappings in browser process → DC0020 Process Modification

  Tunable: SleepyUserThreshold ExtensionInstallPolicy
  AN0501 Identity Provider

  Post-compromise identity & session anomalies that follow a drive-by compromise: token reuse from new/unfamiliar IPs, anomalous sign-in patterns for previously inactive users, unexpected consent/grant events, or provisioning changes. Defender sees an endpoint/browser compromise (network + endpoint signals) followed by unusual IdP events: new refresh token issuance, consent/consent-grant events, odd MFA bypass patterns, or unusual OAuth client registrations.

  azure:signinlogs SignIn: Sign-ins flagged as atypical (new geographic region, unfamiliar device id) shortly after correlated endpoint/browser compromise times → DC0002 User Account Authentication

  m365:unified Application Consent grants, new OAuth client registrations, or unusual admin-level activities executed by a user account shortly after suspected drive-by compromise → DC0038 Application Log Content

  saas:auth Refresh token issuance or refresh token usage from new IPs or user agents → DC0013 User Account Metadata

  AWS:CloudTrail ConsoleLogin: If IdP backed by cloud provider, Console login from new IP/agent after correlated endpoint compromise → DC0067 Logon Session Creation

  Tunable: IdpAlertWindow HighRiskCountryList DeviceTrustLevel

Sigma rules tagged attack.t1189 (3)

T1204.002 Malicious File exploitation technique

• DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
  AN0819 Windows

  User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

  Tunable: TimeWindow SuspiciousExtensions UserPaths ParentApps SignerAllowList
  AN0820 macOS

  User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.

  macos:unifiedlog process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder} → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions → DC0039 File Creation

  Tunable: TimeWindow QuarantineRequired ParentApps
  AN0821 Linux

  User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.

  auditd:SYSCALL open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions → DC0039 File Creation

  auditd:SYSCALL execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser → DC0032 Process Creation

  Tunable: TimeWindow DesktopParentMap

Sigma rules tagged attack.t1204.002 (39)

All 39 rules on the technique page →

T1499.004 Application or System Exploitation primary impact

• DET0304 Detection Strategy for Endpoint DoS via Application or System Exploitation
  AN0850 Windows

  Exploitation of system or application vulnerability (e.g., CVE-based exploit) followed by service crash, restart, or repeated failure within a short time frame, impacting application/system availability.

  WinEventLog:Application EventCode=1000 → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:System EventCode=7031, 7034 → DC0060 Service Creation

  Tunable: TimeWindow TargetApplication
  AN0851 Linux

  User or remote input triggers application crash or segmentation fault (e.g., SIGSEGV) with service recovery attempts, observed via audit logs and systemd journaling.

  auditd:SYSCALL Process segfault or abnormal termination after invoking vulnerable syscall sequence → DC0033 Process Termination

  journald:Application Segfault or crash log entry associated with specific application binary → DC0038 Application Log Content

  NSM:Flow Unusual request pattern leading up to service crash (e.g., malformed or oversized payload) → DC0085 Network Traffic Content

  Tunable: CrashPattern ExploitSourceIP
  AN0852 macOS

  Application crash or repeated restart cycle triggered by malformed input or exploit file, observed via unified logs and process crash monitoring.

  macos:unifiedlog Crash log entries for a process receiving malformed input or known exploit patterns → DC0038 Application Log Content

  macos:unifiedlog Unusual child process tree indicating attempted recovery after crash → DC0032 Process Creation

  Tunable: CrashSignature InputVector
  AN0853 IaaS

  Cloud workload exploitation leads to repeated container, service, or VM termination/restart, typically associated with CVE-based crash triggers or fuzzed payloads.

  AWS:CloudTrail TerminateInstances → DC0089 Instance Stop

  AWS:CloudWatch Repeated crash pattern within container or instance logs → DC0038 Application Log Content

  AWS:VPCFlowLogs Large volume of malformed or synthetic payloads to application endpoints prior to failure → DC0085 Network Traffic Content

  Tunable: CrashThreshold ServiceID

Sigma rules tagged attack.t1499.004 (3)