Coverage › CVE-2021-44168

CVE-2021-44168 Mapped Partial Sigma

Fortinet FortiOS Arbitrary File Download

Vendor / product

Fortinet — FortiOS

Description (CISA)

Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.

Added to KEV

2021-12-10

Due date

2021-12-24

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

CWE-494

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2021-44168

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1078.003 Local Accounts exploitation technique

• DET0407 Detection of Local Account Abuse for Initial Access and Persistence
  AN1137 Windows

  Detects anomalous usage of local accounts to log into a system, especially accounts not typically used interactively or outside business hours.

  WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  Tunable: TimeWindow UserContext
  AN1138 Linux

  Detects interactive or service logins from local accounts outside expected operational context or at anomalous times.

  auditd:USER_LOGIN USER_LOGIN → DC0088 Logon Session Metadata

  linux:auth sshd login → DC0002 User Account Authentication

  Tunable: TimeWindow HostRole
  AN1139 macOS

  Detects abnormal or rare logins via local accounts through system or remote mechanisms such as SSH.

  macos:unifiedlog loginwindow or sshd → DC0088 Logon Session Metadata

  Tunable: UserContext TimeWindow

Sigma rules tagged attack.t1078.003 (5)

T1601 Modify System Image primary impact

• DET0170 Detection Strategy for Modify System Image on Network Devices
  AN0482 Network Devices

  Defenders may observe adversary attempts to alter or replace a network device’s operating system image through anomalous CLI commands, unexpected firmware updates, integrity check failures, or mismatches in version and checksum validation. Suspicious behavior includes modification of image files on storage, OS version output inconsistent with baselines, unexpected reloads or reboots after image replacement, and changes to boot configuration that load non-standard system images.

  networkdevice:cli Execution of commands to load, copy, or replace system images (e.g., 'copy tftp flash', 'boot system') → DC0064 Command Execution

  networkdevice:config Configuration changes to boot variables, startup image paths, or checksum verification failures → DC0061 File Modification

  Tunable: AuthorizedAdminAccounts ApprovedFirmwareVersions TimeWindow ChecksumBaseline

Sigma rules tagged attack.t1601 (0)

None. MITRE's strategy above is the only public detection guidance for this technique.