Coverage › CVE-2020-8193

CVE-2020-8193 Mapped Sigma

Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability

Vendor / product

Citrix — Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance

Description (CISA)

Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.

Added to KEV

2021-11-03

Due date

2022-05-03

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

CWE-284

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2020-8193

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1005 Data from Local System primary impact

• DET0380 Detection of Local Data Collection Prior to Exfiltration
  AN1070 Windows

  Adversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: TargetFilePathRegex ParentProcessFilter
  AN1071 Linux

  Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.

  auditd:SYSCALL open → DC0055 File Access

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: TimeWindow ScriptToolName
  AN1072 macOS

  Adversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.

  macos:unifiedlog process:spawn → DC0032 Process Creation

  fs:fsusage read/write → DC0055 File Access

  Tunable: UserContext TargetVolume
  AN1073 Network Devices

  Collection of device configuration via CLI commands (e.g., show running-config, copy flash, more), often followed by TFTP/SCP transfers.

  networkdevice:cli command logging → DC0064 Command Execution

  Tunable: CommandScope AuthenticatedUserList
  AN1074 ESXi

  Adversaries accessing datastore or configuration files via vim-cmd, esxcli, or SCP to extract logs, VMs, or host configurations.

  esxis:vmkernel Datastore Access → DC0055 File Access

  esxi:hostd Command Execution → DC0064 Command Execution

  Tunable: AccessPathRegex InteractiveShellUsage

Sigma rules tagged attack.t1005 (14)

T1556 Modify Authentication Process exploitation technique

• DET0104 Detect Modification of Authentication Processes Across Platforms
  AN0287 Windows

  Detects modification of LSASS and authentication DLLs, suspicious registry changes to password filter packages, and abnormal process access to lsass.exe. Correlates registry modifications, DLL loads, and process handle access events.

  WinEventLog:Security EventCode=4657 → DC0063 Windows Registry Key Modification

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  Tunable: MonitoredRegistryKeys TimeWindow
  AN0288 Linux

  Detects modification of PAM configuration files, unauthorized new PAM modules, and suspicious process execution accessing PAM-related binaries. Correlates file modification events in /etc/pam.d/ with process execution of unauthorized binaries.

  auditd:SYSCALL open, write → DC0061 File Modification

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: WatchedPaths
  AN0289 macOS

  Detects unauthorized additions or changes to /Library/Security/SecurityAgentPlugins and suspicious process activity attempting to hook authentication APIs. Correlates file modifications with abnormal plugin loads in authentication flows.

  macos:unifiedlog SecurityAgentPlugins modification → DC0061 File Modification

  macos:osquery process_open → DC0035 Process Access

  Tunable: PluginPaths
  AN0290 Identity Provider

  Detects suspicious configuration changes in IdP authentication flows such as enabling reversible password encryption, MFA bypass, or policy weakening. Correlates policy modification events with unusual administrative activity.

  azure:policy UpdatePolicy → DC0069 Cloud Service Modification

  m365:unified Set-ADUser OR Set-ADAccountControl → DC0010 User Account Modification

  Tunable: PolicyBaseline
  AN0291 IaaS

  Detects unauthorized changes to IAM authentication configurations such as disabling MFA, creating backdoor access keys, or altering trust policies. Correlates identity policy updates with unusual login behavior.

  AWS:CloudTrail UpdateLoginProfile → DC0010 User Account Modification

  AWS:CloudTrail UpdateAccountPasswordPolicy → DC0069 Cloud Service Modification

  Tunable: ApprovedAccounts

Sigma rules tagged attack.t1556 (12)

Sigma rules tagged with this CVE directly

1 rule carries cve.2020-8193.