Coverage › CVE-2017-6742
CVE-2017-6742 Mapped Partial Sigma
Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
- Vendor / product
- Cisco — IOS and IOS XE Software
- Description (CISA)
- The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
- Added to KEV
- 2023-04-19
- Due date
- 2023-05-10
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Unknown
- CWE
- CWE-119
- CISA notes
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp
https://nvd.nist.gov/vuln/detail/CVE-2017-6742 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1574 Hijack Execution Flow | exploitation technique | CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem.
Reported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as "Jaguar Tooth", as detailed in the NCSC’s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor. ref 1 · ref 2 · ref 3 |
live |
| T1048 Exfiltration Over Alternative Protocol | secondary impact | CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem.
Reported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as "Jaguar Tooth", as detailed in the NCSC’s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor. ref 1 · ref 2 · ref 3 |
live |
| T1059 Command and Scripting Interpreter | primary impact | CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem.
Reported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as "Jaguar Tooth", as detailed in the NCSC’s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor. ref 1 · ref 2 · ref 3 |
live |
| T1542.005 TFTP Boot | secondary impact | CVE-2017-6742 is a Simple Network Management Protocol (SNMP) vulnerability in Cisco products related to a buffer overflow condition in the SNMP subsystem.
Reported by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as "Jaguar Tooth", as detailed in the NCSC’s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor. ref 1 · ref 2 · ref 3 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1048 Exfiltration Over Alternative Protocol secondary impact
- DET0131 Behavioral Detection Strategy for Exfiltration Over Alternative Protocol
AN0367 WindowsDetects unusual outbound file transfer behavior using protocols like FTP, SMB, SMTP, or DNS, involving non-standard processes, off-hour activity, or uncommonly high volume.Tunable:
DataVolumeThresholdMBProtocolAllowListTimeWindowParentProcessAnomalyAN0368 LinuxDetects file exfiltration using tools like curl, scp, or custom binaries over protocols such as FTP, HTTP/S, or DNS tunneling, especially outside baseline user behavior.Tunable:ProtocolTypeUserContextFileExtensionSensitivityAN0369 macOSDetects non-native file transfer via curl, Python scripts, or AppleScript using uncommon protocols like FTP, SMTP, or DNS exfiltration through mDNSResponder abuse.macos:unifiedloglog stream (subsystem: com.apple.system.networking)→ DC0085 Network Traffic ContentTunable:ProtocolUnusualnessScoreExecutableBaseliningAN0370 IaaSDetects access to cloud APIs or CLI tools to move or sync files from sensitive buckets to external endpoints using protocols like HTTPS or S3 APIs.Tunable:IAMRoleContextGeoDestinationThresholdAN0371 ESXiDetects outbound traffic from hostd/vpxa or guest VM interfaces using unauthorized protocols such as FTP, HTTP POST bursts, or long-lived DNS tunnels.Tunable:GuestTrafficBaselineServiceAccountProfile
Sigma rules tagged attack.t1048 (12)
Author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-17 · logsource: product=windows category=process_creation · 6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7
Detects the execution of the Restic backup tool, which can be used for data exfiltration.
Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services.
If not legitimately used in the enterprise environment, its presence may indicate malicious activity.
Author: frack113
· 2025-10-12 · logsource: product=windows category=process_creation · 7674f8ef-7141-4cf0-a311-ee359264c64c
Detects the execution of Winscp from an a non standard folder. This could indicate the execution of Winscp portable.
Author: Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali
· 2019-12-30 (modified 2025-10-22) · logsource: product=windows category=process_creation · 855bc8b5-2ae8-402e-a9ed-b889e6df1900
Detects a copy command or a copy utility execution to or from an Admin share or remote
Author: Daniil Yugoslavskiy, Ian Davis, oscd.community
· 2019-10-24 (modified 2022-12-25) · logsource: product=windows service=system · 8e4cf0e5-aa5d-4dc3-beff-dc26917744a9
Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques
Author: Daniil Yugoslavskiy, Ian Davis, oscd.community
· 2019-10-24 (modified 2023-12-11) · logsource: product=windows category=process_creation · 99793437-3e16-439b-be0f-078782cf953d
Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques
Author: Daniil Yugoslavskiy, Ian Davis, oscd.community
· 2019-10-24 (modified 2022-11-29) · logsource: product=windows service=security · 9c8afa4d-0022-48f0-9456-3712466f9701
Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.
Author: Saw Winn Naung , Azure-Sentinel
· 2021-08-15 (modified 2025-09-12) · logsource: product=zeek service=dns · a8322756-015c-42e7-afb1-436e85ed3ff5
Identifies IPs performing DNS lookups associated with common Tor proxies.
Author: Florian Roth (Nextron Systems)
· 2022-01-16 (modified 2023-12-28) · logsource: product=windows category=process_creation · ab9e3b40-0c85-4ba1-aede-455d226fd124
Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=windows category=dns_query · ac5a4e3f-7f9d-6abc-d8ea-3b4c5f6a7b8c
Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on.
The domain git-tanstack.com (registered May 9, 2026) hosted secondary payloads including transformers.pyz.
The filev2.getsession.org endpoint was used for credential exfiltration via the Session protocol.
Author: frack113
· 2025-10-12 · logsource: product=windows category=process_creation · c1477deb-37cf-4439-9ffb-44499acb89d0
Detects the execution of Winscp with the "-command" and the "open" flags in order to open an FTP connection. Akira ransomware was seen using this technique in order to exfiltrate data.
Author: Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems)
· 2024-08-20 · logsource: product=windows category=process_creation · c615d676-f655-46b9-b913-78729021e5d7
Detects the execution of the BCP utility in order to export data from the database.
Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.
Author: frack113
· 2022-01-07 · logsource: product=windows category=ps_script · d59d7842-9a21-4bc6-ba98-64bfe0091355
DNSExfiltrator allows for transferring (exfiltrate) a file over a DNS request covert channel
T1059 Command and Scripting Interpreter primary impact
- DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
AN1428 WindowsDetects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.Tunable:
CommandLinePatternParentProcessNameTimeWindowAN1429 LinuxDetects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.Tunable:InterpreterNameUserContextExecutionChainLengthAN1430 macOSDetects launch of command-line interpreters via Terminal, Automator, or hiddenosascript, especially when parent process lineage deviates from user-initiated applications.macos:unifiedloglog stream --info --predicate 'eventMessage CONTAINS "exec"'→ DC0032 Process CreationTunable:LaunchAgentNameScriptNameTerminalAppUsageAN1431 ESXiDetects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.Tunable:ShellEnabledFlagSSHContextAN1432 Network DevicesIdentifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) viaenablemode or scripting-capable sessions used by uncommon accounts or from unknown IPs.Tunable:UserRoleDeviceType
Sigma rules tagged attack.t1059 (95)
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
Detects usage of winget to add new additional download sources
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Author: Josh Nickels, Marius Rothenbücher
· 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Author: Florian Roth (Nextron Systems)
· 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43
Detects Windows shells and scripting applications that write files to suspicious folders
Author: frack113, Tim Shelton (update fp)
· 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe.
This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs
process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other
processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
All 95 rules on the technique page →
T1542.005 TFTP Boot secondary impact
- DET0582 Detection Strategy for T1542.005 Pre-OS Boot: TFTP Boot
AN1603 Network DevicesDetection of unauthorized changes to boot configurations pointing to TFTP servers, unusual firmware loads during netbooting, or suspicious TFTP traffic. Correlation of boot config modifications, command history logs, and unexpected system image hashes provides detection coverage for adversaries attempting to persist via malicious TFTP boot images.networkdevice:config
Configuration changes referencing 'boot system tftp' or modification of startup-config pointing to external TFTP servers→ DC0064 Command Executionnetworkdevice:syslogBoot information log showing image loaded from TFTP server instead of local storage→ DC0004 Firmware ModificationNSM:FlowUnexpected inbound/outbound TFTP traffic for device image files→ DC0082 Network Connection CreationTunable:ApprovedTFTPServersTimeWindowBaselineBootImageHash
Sigma rules tagged attack.t1542.005 (0)
None. MITRE's strategy above is the only public detection guidance for this technique.
T1574 Hijack Execution Flow exploitation technique
- DET0218 Detection Strategy for Hijack Execution Flow across OS platforms.
AN0609 WindowsUnusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.Tunable:
ServiceBaselineAllowedDllPathsTimeWindowAN0610 LinuxAdversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.auditd:SYSCALLopen/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin→ DC0061 File ModificationTunable:MonitoredDirectoriesEnvVarMonitorsAN0611 macOSAbuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.macos:unifiedlogModified application plist or binary replacement in /Applications→ DC0061 File ModificationTunable:AllowedDylibPathsPlistMonitors
Sigma rules tagged attack.t1574 (8)
Author: FPT.EagleEye, Thomas Patzke (improvements)
· 2021-06-29 (modified 2022-06-02) · logsource: product=windows category=image_load · 02fb90de-c321-4e63-a6b9-25f4b03dfd14
Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
· 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Author: Florian Roth (Nextron Systems)
· 2019-07-17 (modified 2023-05-24) · logsource: product=windows category=process_creation · 50919691-7302-437f-8e10-1fe088afa145
Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.
Author: Bhabesh Raj
· 2021-07-01 (modified 2023-02-17) · logsource: product=windows category=file_delete · 5b2bbc47-dead-4ef7-8908-0cf73fcbecbf
Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675
Author: frack113
· 2022-08-07 (modified 2023-08-17) · logsource: product=windows category=registry_set · 9827ae57-3802-418f-994b-d5ecf5cd974b
Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes
Author: Ivan Dyachkov, Yulia Fomina, oscd.community
· 2020-10-07 (modified 2021-11-27) · logsource: product=windows category=process_creation · a2910908-e86f-4687-aeba-76a5f996e652
Detects using register-cimprovider.exe to execute arbitrary dll file.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 · logsource: product=windows category=file_event · dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c
Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
Author: Florian Roth (Nextron Systems)
· 2020-07-01 (modified 2023-08-17) · logsource: product=windows category=registry_set · e0813366-0407-449a-9869-a2db1119dc41
Detects a suspicious printer driver installation with an empty Manufacturer value