Coverage › CVE-2020-0688

CVE-2020-0688 Mapped Sigma

Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

Vendor / product

Microsoft — Exchange Server

Description (CISA)

Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.

Added to KEV

2021-11-03

Due date

2022-05-03

Required action

Apply updates per vendor instructions.

Known ransomware use

Known

CWE

CWE-287

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2020-0688

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1110 Brute Force primary impact

• DET0463 Brute Force Authentication Failures with Multi-Platform Log Correlation
  AN1275 Windows

  High volume of failed logon attempts followed by a successful one from a suspicious user, host, or timeframe

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  Tunable: TimeWindow UserContext FailureThreshold
  AN1276 Linux

  Multiple authentication failures for valid or invalid users followed by success from same IP/user

  auditd:USER_LOGIN USER_AUTH → DC0002 User Account Authentication

  Tunable: TimeWindow IPWhitelist LoginSource
  AN1277 Identity Provider

  Password spraying or brute force attempts across user pool within short time intervals

  azure:signinlogs Sign-in logs → DC0002 User Account Authentication

  Tunable: UsernameSprayThreshold GeoAnomaly
  AN1278 macOS

  Multiple failed authentications in unified logs (e.g., loginwindow or sshd)

  macos:unifiedlog auth → DC0002 User Account Authentication

  Tunable: TimeWindow TargetUser
  AN1279 SaaS

  Excessive login attempts followed by success from SaaS apps like O365, Dropbox, etc.

  m365:unified Sign-in logs → DC0002 User Account Authentication

  Tunable: AppName UserGroup

Sigma rules tagged attack.t1110 (25)

All 25 rules on the technique page →

T1114 Email Collection primary impact

• DET0476 Email Collection via Local Email Access and Auto-Forwarding Behavior
  AN1309 Windows

  Correlates creation of email forwarding rules or header anomalies (e.g., X-MS-Exchange-Organization-AutoForwarded) with suspicious process execution, file access of .pst/.ost files, and network connections to external SMTP servers.

  WinEventLog:Security EventCode=5145 → DC0102 Network Share Access

  WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

  WinEventLog:Application Exchange logs or header artifacts → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: TimeWindow UserContext SMTPDomainList
  AN1310 Linux

  Detects file access to mbox/maildir files in conjunction with curl/wget/postfix execution, or anomalous shell scripts harvesting user mail directories.

  auditd:SYSCALL open → DC0055 File Access

  linux:syslog postfix/smtpd → DC0082 Network Connection Creation

  linux:osquery process_events → DC0032 Process Creation

  Tunable: WatchedMailDirs ProcessNameList TimeWindow
  AN1311 macOS

  Monitors Mail.app database or maildir file access, automation via AppleScript, and abnormal mail rule creation using scripting or UI automation frameworks.

  macos:unifiedlog Mail or AppleScript subsystem → DC0038 Application Log Content

  macos:endpointsecurity es_event_open, es_event_exec → DC0055 File Access

  Tunable: ScriptProcessNameList WatchedMailFiles
  AN1312 Office Suite

  Correlates unusual auto-forwarding rule creation via Exchange Web Services or Outlook rules engine, presence of X-MS-Exchange-Organization-AutoForwarded headers, and logon session anomalies from abnormal IPs.

  m365:unified Set-Mailbox, New-InboxRule → DC0064 Command Execution

  m365:exchange MessageTrace logs → DC0038 Application Log Content

  azure:ad SignInEvents → DC0067 Logon Session Creation

  Tunable: UserAgentList ExternalSMTPDomainList TimeWindow

Sigma rules tagged attack.t1114 (4)

T1190 Exploit Public-Facing Application exploitation technique

• DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
  AN0219 Windows

  Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

  ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList
  AN0220 Linux

  Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

  ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

  Tunable: WebProcList ChildToolList BurstThreshold TimeWindow
  AN0221 macOS

  Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

  macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content

  macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation

  NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

  Tunable: ServiceList TimeWindow
  AN0222 Containers

  Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

  ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content

  docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation

  NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

  Tunable: IngressNamespaces MetadataEndpoints TimeWindow
  AN0223 IaaS

  Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

  ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content

  AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

  Tunable: LBProjects ErrorBurst
  AN0224 ESXi

  Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

  esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content

  NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

  Tunable: MgmtCIDR TimeWindow
  AN0225 Network Devices

  Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

  networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content

  NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

  Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged attack.t1190 (149)

All 149 rules on the technique page →

T1505.003 Web Shell secondary impact

• DET0394 Web Shell Detection via Server Behavior and File Execution Chains
  AN1108 Windows

  Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation

  NSM:Flow Inbound HTTP POST with suspicious payload size or user-agent → DC0085 Network Traffic Content

  Tunable: WebRootPath ParentProcess
  AN1109 Linux

  File creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx

  auditd:SYSCALL new file created in /var/www/html, /srv/http, or similar web root → DC0039 File Creation

  auditd:SYSCALL apache2 or nginx spawning sh, bash, or python interpreter → DC0032 Process Creation

  NSM:Flow POST requests to .php, .jsp, .aspx files with high entropy body → DC0085 Network Traffic Content

  Tunable: WebRootPath PayloadEntropyThreshold TimeWindow
  AN1110 macOS

  Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www

  macos:unifiedlog httpd spawning bash, zsh, python, or osascript → DC0032 Process Creation

  auditd:SYSCALL file write operations in /Library/WebServer/Documents → DC0061 File Modification

  Tunable: InterpreterName ExecutionParent

Sigma rules tagged attack.t1505.003 (35)

All 35 rules on the technique page →

Sigma rules tagged with this CVE directly

3 rules carry cve.2020-0688.