Coverage › CVE-2019-11510

CVE-2019-11510 Mapped Sigma

Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

Vendor / product: Ivanti — Pulse Connect Secure
Description (CISA): Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.
Added to KEV: 2021-11-03
Due date: 2022-05-03
Required action: Apply updates per vendor instructions.
Known ransomware use: Known
CWE: CWE-22
CISA notes: Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2019-11510
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1133 External Remote Services	exploitation technique	CVE 2019-11510 Pulse Secure Connect is vulnerable to unauthenticated arbitrary file disclosure. An attacker can exploit this vulnerability to gain access to administrative credentials. ref 1 · ref 2	live
T1059 Command and Scripting Interpreter	primary impact	CVE 2019-11510 Pulse Secure Connect is vulnerable to unauthenticated arbitrary file disclosure. An attacker can exploit this vulnerability to gain access to administrative credentials. ref 1 · ref 2	live
T1083 File and Directory Discovery	secondary impact	CVE 2019-11510 Pulse Secure Connect is vulnerable to unauthenticated arbitrary file disclosure. An attacker can exploit this vulnerability to gain access to administrative credentials. ref 1 · ref 2	live
T1552.001 Credentials In Files	secondary impact	CVE 2019-11510 Pulse Secure Connect is vulnerable to unauthenticated arbitrary file disclosure. An attacker can exploit this vulnerability to gain access to administrative credentials. ref 1 · ref 2	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059 Command and Scripting Interpreter primary impact

DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
AN1428 Windows
Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: CommandLinePattern ParentProcessName TimeWindow

AN1429 Linux
Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

auditd:SYSCALL execve → DC0032 Process Creation

Tunable: InterpreterName UserContext ExecutionChainLength

AN1430 macOS
Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

Tunable: LaunchAgentName ScriptName TerminalAppUsage

AN1431 ESXi
Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

esxi:vobd shell session start → DC0064 Command Execution

Tunable: ShellEnabledFlag SSHContext

AN1432 Network Devices
Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

networkdevice:cli shell command → DC0064 Command Execution
networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

Tunable: UserRole DeviceType

Sigma rules tagged `attack.t1059` (95)

Suspicious Browser Child Process - MacOS mediumtest

Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Add New Download Source To Winget mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842

Detects usage of winget to add new additional download sources

Techniques: T1059

Potential Arbitrary Command Execution Via FTP.EXE mediumtest

Author: Victor Sergeev, oscd.community · 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Techniques: T1059 T1202

Use of Pcalua For Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Techniques: T1059

Shai-Hulud Malware Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

Techniques: T1059

Script Interpreter Execution From Suspicious Folder hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba

Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.

Techniques: T1059

DNS Request From Windows Script Host lowtest

Author: Josh Nickels, Marius Rothenbücher · 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c

Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.

Techniques: T1059

Windows Shell/Scripting Application File Write to Suspicious Folder hightest

Author: Florian Roth (Nextron Systems) · 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43

Detects Windows shells and scripting applications that write files to suspicious folders

Techniques: T1059

Elevated System Shell Spawned From Uncommon Parent Location mediumtest

Author: frack113, Tim Shelton (update fp) · 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Techniques: T1059

DarkGate - Autoit3.EXE File Creation By Uncommon Process mediumtest

Author: Micah Babinski · 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

Techniques: T1105 T1059

CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) mediumtest

Author: Andreas Braathen (mnemonic.io) · 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

Techniques: T1059 T1190

CVE tags: CVE-2023-22518

Ruby Inline Command Execution mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Techniques: T1059

Payload Decoded and Decrypted via Built-in Utilities mediumtest

Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

Techniques: T1059 T1204 T1140

Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Techniques: T1059

Renamed PingCastle Binary Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Techniques: T1059 T1202

All 95 rules on the technique page →

T1083 File and Directory Discovery secondary impact

DET0370 Recursive Enumeration of Files and Directories Across Privilege Contexts
AN1040 Windows
Execution of file enumeration commands (e.g., 'dir', 'tree') from non-standard processes or unusual user contexts, followed by recursive directory traversal or access to sensitive locations.

WinEventLog:Security EventCode=4688 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

Tunable: CommandLineRegex UserContext TimeWindow

AN1041 Linux
Use of file enumeration commands (e.g., 'ls', 'find', 'locate') executed by suspicious users or scripts accessing broad file hierarchies or restricted directories.

auditd:SYSCALL execve → DC0032 Process Creation
auditd:PATH PATH → DC0055 File Access

Tunable: FilePathDepth UserContext

AN1042 macOS
Execution of file or directory discovery commands (e.g., 'ls', 'find') from terminal or script-based tooling, especially outside normal user workflows.

macos:unifiedlog log collect --predicate → DC0032 Process Creation
fs:fsusage Filesystem Call Monitoring → DC0055 File Access

Tunable: PredicateScope TimeWindow

AN1043 ESXi
Execution of esxcli commands to enumerate datastore, configuration files, or directory structures by unauthorized or remote users.

esxi:shell Shell Access/Command Execution → DC0064 Command Execution
esxi:hostd vSphere File API Access → DC0055 File Access

Tunable: CLICommandPattern AccessSource

AN1044 Network Devices
Execution of file discovery commands (e.g., 'dir', 'show flash', 'nvram:') from CLI interfaces, especially by unauthorized users or from abnormal source IPs.

networkdevice:syslog CLI Command Logging → DC0064 Command Execution

Tunable: CommandWhitelist SessionOrigin

Sigma rules tagged `attack.t1083` (24)

File and Directory Discovery - MacOS informationaltest

Author: Daniil Yugoslavskiy, oscd.community · 2020-10-19 (modified 2022-11-25) · logsource: product=macos category=process_creation · 089dbdf6-b960-4bcc-90e3-ffc3480c20f6

Detects usage of system utilities to discover files and directories

Techniques: T1083

Shell Execution via Nice - Linux hightest

Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-09-02 · logsource: product=linux category=process_creation · 093d68c7-762a-42f4-9f46-95e79142571a

Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Techniques: T1083

Powershell Directory Enumeration mediumtest

Author: frack113 · 2022-03-17 · logsource: product=windows category=ps_script · 162e69a7-7981-4344-84a9-0f1c9a217a52

Detects technique used by MAZE ransomware to enumerate directories using Powershell

Techniques: T1083

PUA - Seatbelt Execution hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-10-18 (modified 2023-02-04) · logsource: product=windows category=process_creation · 38646daa-e78f-4ace-9de0-55547b2d30da

Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

Techniques: T1526 T1087 T1083

Notepad Password Files Discovery lowexperimental

Author: The DFIR Report · 2025-02-21 · logsource: product=windows category=process_creation · 3b4e950b-a3ea-44d3-877e-432071990709

Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.

Techniques: T1083

WannaCry Ransomware Activity criticaltest

Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro · 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079

Detects WannaCry ransomware activity

Techniques: T1210 T1083 T1222.001 T1486 T1490

PUA - TruffleHog Execution mediumexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-09-24 · logsource: product=windows category=process_creation · 44030449-b0df-4c94-aae1-502359ab28ee

Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.

Techniques: T1083 T1552.001

Shell Execution via Flock - Linux hightest

Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-09-02 · logsource: product=linux category=process_creation · 4b09c71e-4269-4111-9cdd-107d8867f0cc

Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Techniques: T1083

Shell Execution via Find - Linux hightest

Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-09-02 · logsource: product=linux category=process_creation · 6adfbf8f-52be-4444-9bac-81b539624146

Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.

Techniques: T1083

Vim GTFOBin Abuse - Linux hightest

Author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux · 2022-12-28 (modified 2026-06-05) · logsource: product=linux category=process_creation · 7ab8f73a-fcff-428b-84aa-6a5ff7877dea

Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

Techniques: T1059 T1083

Powershell Sensitive File Discovery mediumtest

Author: frack113 · 2022-09-16 · logsource: product=windows category=ps_script · 7d416556-6502-45b2-9bad-9d2f05f38997

Detect adversaries enumerate sensitive files

Techniques: T1083

Potential Discovery Activity Using Find - Linux mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-28 · logsource: product=linux category=process_creation · 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf

Detects usage of "find" binary in a suspicious manner to perform discovery

Techniques: T1083

Potential Discovery Activity Using Find - MacOS mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-28 · logsource: product=macos category=process_creation · 85de3a19-b675-4a51-bfc6-b11a5186c971

Detects usage of "find" binary in a suspicious manner to perform discovery

Techniques: T1083

Source Code Enumeration Detection by Keyword mediumtest

Author: James Ahearn · 2019-06-08 (modified 2022-10-05) · logsource: category=webserver · 953d460b-f810-420a-97a2-cfca4c98e602

Detects source code enumeration that use GET requests by keyword searches in URL strings

Techniques: T1083

Cisco Discovery lowtest

Author: Austin Clark · 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b

Find information about network devices that is not stored in config files

Techniques: T1083 T1201 T1057 T1018 T1082 T1016 T1049 T1033 T1124

All 24 rules on the technique page →

T1133 External Remote Services exploitation technique

DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
AN1004 Windows
Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.

WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication
WinEventLog:Application VPN, Citrix, or remote access gateway logs showing external IP addresses → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: BusinessHours KnownRemoteIPs FailedLogonThreshold GeoIPWhitelist TimeWindow

AN1005 Linux
Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).

auditd:SYSCALL ssh logins or execve of remote commands → DC0088 Logon Session Metadata
NSM:Connections Failed password or accepted password for SSH users → DC0038 Application Log Content
NSM:Flow connection: Inbound connections to SSH or VPN ports → DC0082 Network Connection Creation

Tunable: KnownSSHClients FailedLogonThreshold TimeWindow

AN1006 macOS
Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.

macos:unifiedlog Remote login (ssh) or screen sharing authentication attempts → DC0088 Logon Session Metadata
macos:unifiedlog Inbound connections to VNC/SSH ports → DC0082 Network Connection Creation
PF:Logs External traffic to remote access services → DC0078 Network Traffic Flow

Tunable: KnownVNCServers TimeWindow

AN1007 Containers
Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.

ApplicationLog:API Docker/Kubernetes API access from external sources → DC0038 Application Log Content
kubernetes:audit Unauthorized container creation or kubelet exec logs → DC0088 Logon Session Metadata
NSM:Flow External access to container ports (2375, 6443) → DC0082 Network Connection Creation

Tunable: AllowedCIDRs TimeWindow

Sigma rules tagged `attack.t1133` (20)

Remote Access Tool - Team Viewer Session Started On Linux Host lowtest

Author: Josh Nickels, Qi Nan · 2024-03-11 · logsource: product=linux category=process_creation · 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Techniques: T1133

External Remote RDP Logon from Public IP mediumtest

Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) · 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Techniques: T1133 T1078 T1110

FortiGate - New VPN SSL Web Portal Added mediumexperimental

Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · 2025-11-01 · logsource: product=fortigate service=event · 2bfb6216-0c31-4d20-8501-2629b29a3fa2

Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings.

Techniques: T1133

OpenCanary - Telnet Login Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 512cff7a-683a-43ad-afe0-dd398e872f36

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Techniques: T1133 T1078

OpenCanary - RDP New Connection Attempt highexperimental

Author: Marco Pedrinazzi (@pedrinazziM) · 2026-01-06 · logsource: product=opencanary category=application · 598290cf-5932-45cd-9123-be1e05ab4f2e

Detects instances where an RDP service on an OpenCanary node has had a connection attempt.

Techniques: T1133 T1021.001

Potential Exploitation of GoAnywhere MFT Vulnerability highexperimental

Author: MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-10-07 · logsource: product=windows category=process_creation · 6c76b3d0-afe4-4870-9443-ffe6773c5fef

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

Techniques: T1190 T1059.001 T1133

CVE tags: CVE-2025-10035

Remote Access Tool - ScreenConnect Installation Execution mediumtest

Author: Florian Roth (Nextron Systems) · 2021-02-11 (modified 2024-02-26) · logsource: product=windows category=process_creation · 75bfe6e6-cd8e-429e-91d3-03921e1d7962

Detects ScreenConnect program starts that establish a remote access to a system.

Techniques: T1133

External Remote SMB Logon from Public IP hightest

Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) · 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 78d5cab4-557e-454f-9fb9-a222bd0d5edc

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Techniques: T1133 T1078 T1110

FortiGate - VPN SSL Settings Modified mediumexperimental

Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · 2025-11-01 · logsource: product=fortigate service=event · 8b5dacf2-aeb7-459d-b133-678eb696d410

Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal.

Techniques: T1133

Unusual File Deletion by Dns.exe hightest

Author: Tim Rauch (Nextron Systems), Elastic (idea) · 2022-09-27 (modified 2023-02-15) · logsource: product=windows category=file_delete · 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0

Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Techniques: T1133

Unusual File Modification by dns.exe hightest

Author: Tim Rauch (Nextron Systems), Elastic (idea) · 2022-09-27 · logsource: product=windows category=file_change · 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3

Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Techniques: T1133

Unusual Child Process of dns.exe hightest

Author: Tim Rauch, Elastic (idea) · 2022-09-27 (modified 2023-02-05) · logsource: product=windows category=process_creation · a4e3d776-f12e-42c2-8510-9e6ed1f43ec3

Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Techniques: T1133

Remote Access Tool - Team Viewer Session Started On Windows Host lowtest

Author: Josh Nickels, Qi Nan · 2024-03-11 · logsource: product=windows category=process_creation · ab70c354-d9ac-4e11-bbb6-ec8e3b153357

Techniques: T1133

Running Chrome VPN Extensions via the Registry 2 VPN Extension hightest

Author: frack113 · 2021-12-28 (modified 2023-08-17) · logsource: product=windows category=registry_set · b64a026b-8deb-4c1d-92fd-98893209dff1

Running Chrome VPN Extensions via the Registry install 2 vpn extension

Techniques: T1133

OpenCanary - SSH New Connection Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

Techniques: T1133 T1021 T1078

All 20 rules on the technique page →

T1552.001 Credentials In Files secondary impact

DET0307 Detect Access to Unsecured Credential Files Across Platforms
AN0856 Windows
Correlated file access to insecure credential files (e.g., .env, .xml, *.ps1) followed by suspicious process execution or authentication using retrieved credentials. Detected through Sysmon logs and Windows Security Event logs.

WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation

Tunable: FileNamePattern ProcessAccessScope TimeWindow

AN0857 Linux
File reads or process executions involving insecurely stored credential files (e.g., config files with password fields) by non-root or anomalous users followed by ssh authentication attempts.

auditd:SYSCALL open/read of sensitive config or secret files → DC0055 File Access
auditd:EXECVE grep/cat/awk on files with password fields → DC0064 Command Execution
linux:syslog authentication success after file access → DC0067 Logon Session Creation

Tunable: RegexPatterns UserContextScope TimeWindow

AN0858 macOS
Terminal-based grep or open of plist/config files containing credentials, correlated with Keychain or system login attempts.

macos:unifiedlog grep/cat on files matching credential patterns → DC0064 Command Execution
macos:unifiedlog open/read of *.plist or .env files → DC0055 File Access
macos:unifiedlog Keychain or user login post-access → DC0067 Logon Session Creation

Tunable: KeychainToolAccess FileTypeList

AN0859 Containers
Container processes accessing mounted secrets or configuration paths (e.g., /run/secrets, /mnt/config) followed by network access or credential use.

ebpf:syscalls open/read on secret mount paths → DC0055 File Access
kubernetes:audit process execution involving curl, grep, or awk on secrets → DC0064 Command Execution
cni:netflow outbound connection to internal or external APIs → DC0082 Network Connection Creation

Tunable: SecretMountPaths ProcessBaselineDeviation

AN0860 IaaS
Access to local credential/config files (e.g., ~/.aws/credentials) followed by metadata API calls or cloud role assumptions.

CloudTrail:GetObject sensitive credential files in buckets or local image storage → DC0055 File Access
AWS:CloudTrail command-line execution invoking credential enumeration → DC0064 Command Execution
AWS:CloudTrail sudden role assumption after credential file access → DC0067 Logon Session Creation

Tunable: CredentialFilePattern RoleAssumptionScope TimeWindow

Sigma rules tagged `attack.t1552.001` (24)

Insensitive Subfolder Search Via Findstr.EXE lowtest

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

Techniques: T1218 T1564.004 T1552.001 T1105

Shai-Hulud Malicious GitHub Workflow Creation highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-09-24 (modified 2026-01-24) · logsource: product=linux category=file_event · 0aba5685-6db6-486f-88ef-29a99c545cfd

Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets

Techniques: T1552.001 T1119

Linux Recon Indicators hightest

Author: Florian Roth (Nextron Systems) · 2022-06-20 · logsource: product=linux category=process_creation · 0cf7a157-8879-41a2-8f55-388dd23746b7

Detects events with patterns found in commands used for reconnaissance on linux systems

Techniques: T1592.004 T1552.001

Potential Password Reconnaissance Via Findstr.EXE mediumtest

Author: Josh Nickels · 2023-05-18 · logsource: product=windows category=process_creation · 1a0f6f16-2099-4753-9a02-43b6ac7a1fa5

Detects command line usage of "findstr" to search for the "passwords" keyword in a variety of different languages

Techniques: T1552.001

Hidden Flag Set On File/Directory Via Chflags - MacOS mediumtest

Author: Omar Khaled (@beacon_exe) · 2024-08-21 · logsource: product=macos category=process_creation · 3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

Techniques: T1218 T1564.004 T1552.001 T1105

PUA - TruffleHog Execution mediumexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-09-24 · logsource: product=windows category=process_creation · 44030449-b0df-4c94-aae1-502359ab28ee

Techniques: T1083 T1552.001

Azure Key Vault Modified or Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 459a2970-bb84-4e6a-a32e-ff0fbd99448d

Identifies when a key vault is modified or deleted.

Techniques: T1552 T1552.001

Credentials In Files hightest

Author: Igor Fits, Mikhail Larin, oscd.community · 2020-10-19 (modified 2021-11-27) · logsource: product=macos category=process_creation · 53b1b378-9b06-4992-b972-dde6e423d2b4

Detecting attempts to extract passwords with grep and laZagne

Techniques: T1552.001

Remote File Download Via Findstr.EXE mediumtest

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

Techniques: T1218 T1564.004 T1552.001 T1105

Potentially Suspicious JWT Token Search Via CLI mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), kagebunsher · 2022-10-25 (modified 2025-10-21) · logsource: product=windows category=process_creation · 6d3a3952-6530-44a3-8554-cf17c116c615

Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others. Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.

Techniques: T1528 T1552.001

HackTool - Typical HiveNightmare SAM File Export hightest

Author: Florian Roth (Nextron Systems) · 2021-07-23 (modified 2024-06-27) · logsource: product=windows category=file_event · 6ea858a8-ba71-4a12-b2cc-5d83312404c7

Detects files written by the different tools that exploit HiveNightmare

Techniques: T1552.001

CVE tags: CVE-2021-36934

Unattend.XML File Access Attempt lowtest

Author: frack113 · 2024-07-22 · logsource: product=windows category=file_access · 76a26006-0942-430b-8249-bd51d448f8e5

Detects attempts to access the "unattend.xml" file, where credentials might be stored. This file is used during the unattended windows install process.

Techniques: T1552.001

Azure Keyvault Key Modified or Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 80eeab92-0979-4152-942d-96749e11df40

Identifies when a Keyvault Key is modified or deleted in Azure.

Techniques: T1552 T1552.001

HackTool - WinPwn Execution - ScriptBlock hightest

Author: Swachchhanda Shrawan Poudel · 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

Techniques: T1046 T1082 T1106 T1518 T1548.002 T1552.001 T1555 T1555.003

Azure Keyvault Secrets Modified or Deleted mediumtest

Author: Austin Songer @austinsonger · 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · b831353c-1971-477b-abb6-2828edc3bca1

Identifies when secrets are modified or deleted in Azure.

Techniques: T1552 T1552.001

All 24 rules on the technique page →

Sigma rules tagged with this CVE directly

1 rule carries cve.2019-11510.

Pulse Secure Attack CVE-2019-11510 criticaltest

Author: Florian Roth (Nextron Systems) · 2019-11-18 (modified 2023-01-02) · logsource: category=webserver · 2dbc10d7-a797-49a8-8776-49efa6442e60

Detects CVE-2019-11510 exploitation attempt - URI contains Guacamole

Techniques: T1190

CVE tags: CVE-2019-11510

CVE-2019-11510 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059 Command and Scripting Interpreter primary impact

Sigma rules tagged attack.t1059 (95)

T1083 File and Directory Discovery secondary impact

Sigma rules tagged attack.t1083 (24)

T1133 External Remote Services exploitation technique

Sigma rules tagged attack.t1133 (20)

T1552.001 Credentials In Files secondary impact

Sigma rules tagged attack.t1552.001 (24)

Sigma rules tagged with this CVE directly

Sigma rules tagged `attack.t1059` (95)

Sigma rules tagged `attack.t1083` (24)

Sigma rules tagged `attack.t1133` (20)

Sigma rules tagged `attack.t1552.001` (24)