Coverage › CVE-2020-5735
CVE-2020-5735 Mapped Sigma
Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability
- Vendor / product
- Amcrest — Cameras and Network Video Recorder (NVR)
- Description (CISA)
- Amcrest cameras and NVR contain a stack-based buffer overflow vulnerability through port 37777 that allows an unauthenticated, remote attacker to crash the device and possibly execute code.
- Added to KEV
- 2021-11-03
- Due date
- 2022-05-03
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Unknown
- CWE
- CWE-121
- CISA notes
- https://nvd.nist.gov/vuln/detail/CVE-2020-5735
- Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1499 Endpoint Denial of Service | secondary impact | CVE-2020-5735 is a stack-based buffer overflow vulnerability in Amcrest cameras and NVR that allows an authenticated remote attacker to possibly execute unauthorized code over port 37777 and crash the device. ref 1 |
live |
| T1574 Hijack Execution Flow | primary impact | CVE-2020-5735 is a stack-based buffer overflow vulnerability in Amcrest cameras and NVR that allows an authenticated remote attacker to possibly execute unauthorized code over port 37777 and crash the device. ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1499 Endpoint Denial of Service secondary impact
- DET0208 Endpoint Resource Saturation and Crash Pattern Detection Across Platforms
AN0584 WindowsExcessive resource exhaustion or service crash induced by processes launched by users or scripts that rapidly consume CPU/memory or attempt malformed service interactions.WinEventLog:Application
Service crash, unhandled exception, or application hang warnings for critical services (e.g., IIS, DNS, SQL Server)→ DC0038 Application Log ContentWinEventLog:SystemSystem shutdowns due to bugcheck (Event ID 1001) or watchdog timer expirations→ DC0018 Host StatusTunable:TimeWindowServiceTargetCPUThresholdPercentAN0585 LinuxMalicious script or binary causes repeated kernel panics, OOM kills, or systemd service restarts targeting services like nginx, httpd, sshd.journald:systemdRepeated service restart attempts or unit failures→ DC0038 Application Log ContentTunable:ServiceNameRestartThresholdOOMKillCountAN0586 macOSAdversary launches high-entropy process or malformed app bundle causing repeated application crashes and system slowdowns.macos:unifiedlogRepeated process crashes logged by CrashReporter or system instability logs in com.apple.console→ DC0038 Application Log ContentTunable:CrashCountThresholdPayloadEntropyThresholdAN0587 IaaSInstance enters degraded/unhealthy state due to abnormal process load or memory exhaustion, often caused by automation or script-based attacks.AWS:CloudWatchStatusCheckFailed or StatusCheckFailed_System for burstable instances (t2/t3)→ DC0018 Host StatusVPCFlowLogs:AllHigh volume internal traffic with low entropy indicating looped or malicious DoS script→ DC0078 Network Traffic FlowTunable:InstanceTypeFailureThresholdAN0588 ContainersContainer orchestrator logs show crashlooping pods, repeated resource exhaustion, or malicious binaries with infinite loops consuming systemd/cgroup limits.kubernetes:eventsCrashLoopBackOff, OOMKilled, container restart count exceeds threshold→ DC0018 Host Statusdocker:eventsContainer exited with non-zero code repeatedly in short period→ DC0038 Application Log ContentTunable:RestartCountThresholdContainerImageEntropy
Sigma rules tagged attack.t1499 (3)
Author: Samuel Monsempes
· 2025-01-08 · logsource: product=windows service=application · 3f2c93c7-7b2a-4d58-bb8d-6f39422d8148
Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".
Author: Milad Cheraghi
· 2025-05-23 · logsource: product=linux service=auditd · ea61bb82-a5e0-42e6-8537-91d29500f1b9
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-06-02 · logsource: product=windows service=application · f8a66a02-4a16-46e5-b7fd-a42c8a93d137
Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409).
This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability,
which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service,
leading to a stack-based buffer overflow and subsequent crash of the LSASS process.
T1574 Hijack Execution Flow primary impact
- DET0218 Detection Strategy for Hijack Execution Flow across OS platforms.
AN0609 WindowsUnusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.Tunable:
ServiceBaselineAllowedDllPathsTimeWindowAN0610 LinuxAdversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.auditd:SYSCALLopen/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin→ DC0061 File ModificationTunable:MonitoredDirectoriesEnvVarMonitorsAN0611 macOSAbuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.macos:unifiedlogModified application plist or binary replacement in /Applications→ DC0061 File ModificationTunable:AllowedDylibPathsPlistMonitors
Sigma rules tagged attack.t1574 (8)
Author: FPT.EagleEye, Thomas Patzke (improvements)
· 2021-06-29 (modified 2022-06-02) · logsource: product=windows category=image_load · 02fb90de-c321-4e63-a6b9-25f4b03dfd14
Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
· 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Author: Florian Roth (Nextron Systems)
· 2019-07-17 (modified 2023-05-24) · logsource: product=windows category=process_creation · 50919691-7302-437f-8e10-1fe088afa145
Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.
Author: Bhabesh Raj
· 2021-07-01 (modified 2023-02-17) · logsource: product=windows category=file_delete · 5b2bbc47-dead-4ef7-8908-0cf73fcbecbf
Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675
Author: frack113
· 2022-08-07 (modified 2023-08-17) · logsource: product=windows category=registry_set · 9827ae57-3802-418f-994b-d5ecf5cd974b
Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes
Author: Ivan Dyachkov, Yulia Fomina, oscd.community
· 2020-10-07 (modified 2021-11-27) · logsource: product=windows category=process_creation · a2910908-e86f-4687-aeba-76a5f996e652
Detects using register-cimprovider.exe to execute arbitrary dll file.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 · logsource: product=windows category=file_event · dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c
Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
Author: Florian Roth (Nextron Systems)
· 2020-07-01 (modified 2023-08-17) · logsource: product=windows category=registry_set · e0813366-0407-449a-9869-a2db1119dc41
Detects a suspicious printer driver installation with an empty Manufacturer value