Coverage › CVE-2021-44529
CVE-2021-44529 Mapped Sigma
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
- Vendor / product
- Ivanti — Endpoint Manager Cloud Service Appliance (EPM CSA)
- Description (CISA)
- Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).
- Added to KEV
- 2024-03-25
- Due date
- 2024-04-15
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Known ransomware use
- Known
- CWE
- CWE-94
- CISA notes
- https://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US
https://nvd.nist.gov/vuln/detail/CVE-2021-44529 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1190 Exploit Public-Facing Application | exploitation technique | This vulnerability is exploited after an adversary sends a maliciously crafted cookie to the client endpoint (/client/index.php) to exploit Ivanti systems that utilized a malicious version of the "csrf-magic", which creates a backdoor into an Ivanti system. An unauthorized user can then execute malicious code stored in the cookie via Ivanti's "nobody" user account. ref 1 · ref 2 · ref 3 |
live |
| T1195.002 Compromise Software Supply Chain | primary impact | This vulnerability is exploited after an adversary sends a maliciously crafted cookie to the client endpoint (/client/index.php) to exploit Ivanti systems that utilized a malicious version of the "csrf-magic", which creates a backdoor into an Ivanti system. An unauthorized user can then execute malicious code stored in the cookie via Ivanti's "nobody" user account. ref 1 · ref 2 · ref 3 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1190 Exploit Public-Facing Application exploitation technique
- DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
AN0219 WindowsAdversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.ApplicationLog:IIS
IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns)→ DC0038 Application Log ContentTunable:PublicVIPsSuspiciousPatternsErrorRateThresholdTimeWindowAllowedChildListAN0220 LinuxAdversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.ApplicationLog:WebServer/var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors→ DC0038 Application Log ContentNSM:FlowHTTP payloads with SQLi/LFI/JNDI/deserialization indicators→ DC0085 Network Traffic ContentTunable:WebProcListChildToolListBurstThresholdTimeWindowAN0221 macOSAdversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.macos:unifiedlogApp/web server logs ingested via unified logging or filebeat (nginx/apache/node).→ DC0038 Application Log ContentTunable:ServiceListTimeWindowAN0222 ContainersAdversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).ApplicationLog:IngressKubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes→ DC0038 Application Log Contentdocker:eventsDocker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container→ DC0032 Process CreationNSM:FlowRequests towards cloud metadata or command & control from pod IPs→ DC0085 Network Traffic ContentTunable:IngressNamespacesMetadataEndpointsTimeWindowAN0223 IaaSAdversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.ALB:HTTPLogsAWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts→ DC0085 Network Traffic ContentAWS:VPCFlowLogsVPC/NSG flow logs for pod/instance egress to Internet or metadata→ DC0078 Network Traffic FlowTunable:LBProjectsErrorBurstAN0224 ESXiAdversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.esxi:hostd/var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections→ DC0038 Application Log ContentNSM:FlowConnections to TCP 427 (SLP) or vCenter web services from untrusted sources→ DC0085 Network Traffic ContentTunable:MgmtCIDRTimeWindowAN0225 Network DevicesAdversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.networkdevice:controlplaneSyslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands→ DC0038 Application Log ContentTunable:MgmtPortsTrustedAdmins
Sigma rules tagged attack.t1190 (149)
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-30 · logsource: category=webserver · 043c1609-0e32-4462-a6f2-5a0c2da3fafe
Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin
Author: @gott_cyber
· 2022-12-11 (modified 2023-03-24) · logsource: category=webserver · 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3
Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.
Author: Florian Roth (Nextron Systems)
· 2020-07-10 (modified 2023-01-02) · logsource: category=webserver · 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7
Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195
Author: Thomas Patzke
· 2017-08-06 (modified 2020-09-01) · logsource: product=ruby_on_rails category=application · 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a
Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts
Author: Bhabesh Raj
· 2023-02-23 · logsource: category=webserver · 0e1ebc5a-15d0-4bf6-8199-b2535397433a
Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla
Author: Nisarg Suthar
· 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72
Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.
Author: Florian Roth (Nextron Systems)
· 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
Author: jamesc-grafana
· 2024-07-11 · logsource: product=aws service=cloudtrail · 14f3f1c8-02d5-43a2-a191-91ffb52d3015
Detects changes to the security group entries for RDS databases.
This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-20 · logsource: category=proxy · 15697955-6a29-47ca-92e9-0e05efae3260
Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.
Author: Bhabesh Raj
· 2021-01-25 (modified 2023-01-02) · logsource: category=webserver · 15c312b9-00d0-4feb-8870-7d940a4bdc5e
Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188
Author: Moti Harmats
· 2023-02-11 · logsource: product=velocity category=application · 16c86189-b556-4ee8-b4c7-7e350a195a4f
Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.
Author: Bhabesh Raj
· 2021-02-24 (modified 2023-01-02) · logsource: category=webserver · 179ed852-0f9b-4009-93a7-68475910fd86
Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-22 (modified 2023-01-02) · logsource: category=webserver · 181f49fa-0b21-4665-a98c-a57025ebb8c7
Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint
Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton
· 2022-07-19 (modified 2026-06-11) · logsource: category=webserver · 19aa4f58-94ca-45ff-bc34-92e533c0994a
Detects known suspicious (default) user-agents related to scanning/recon tools
Author: Thomas Patzke
· 2017-08-12 (modified 2020-09-01) · logsource: product=python category=application · 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9
Generic rule for SQL exceptions in Python according to PEP 249
All 149 rules on the technique page →
T1195.002 Compromise Software Supply Chain primary impact
- DET0309 Compromised software/update chain (installer/write → first-run/child → egress/signature anomaly)
AN0862 WindowsAdversary ships a tampered application or update: an updater/installer (msiexec/setup/update.exe/vendor service) writes or replaces binaries; on first run it spawns scripts/shells or unsigned DLLs and beacons to non-approved update CDNs/hosts. Detection correlates: (1) process creation of installer/updater → (2) file metadata changes in program paths → (3) first-run children and module/signature anomalies → (4) outbound connections to unexpected hosts within a short window.WinEventLog:Microsoft-Windows-CodeIntegrity/Operational
Unsigned or invalid image for newly installed/updated binaries→ DC0059 File MetadataNSM:FlowFirst-time egress to non-approved update hosts right after install/update→ DC0078 Network Traffic FlowTunable:TimeWindowApprovedUpdateHostsApprovedSignersProgramPathsAN0863 LinuxA compromised package/update (deb/rpm/tarball/AppImage/vendor updater) is installed, writing/overwriting files in /usr/local/bin, /usr/bin, /opt, or ~/.local; first run executes unexpected shells/curl/wget and connects to unapproved hosts. Correlate package/updater execution → file writes/replace → first-run child processes → egress.journald:packagedpkg/apt/yum/dnf transaction logs; vendor updaters in systemd journals→ DC0059 File MetadataTunable:PathScopeApprovedReposTimeWindowAN0864 macOSA tampered app/pkg/notarized update is installed via installer, softwareupdated, Homebrew, or vendor updater; new Mach-O or bundle contents appear in /Applications, /Library, /usr/local or /opt/homebrew; first run spawns sh/zsh/osascript/curl and makes egress to unfamiliar domains; AMFI/Gatekeeper may log signature/notarization problems.Tunable:AllowedTeamIDsBrewTapsAllowListTimeWindow
Sigma rules tagged attack.t1195.002 (17)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-02-02 (modified 2026-03-16) · logsource: product=windows category=dns_query · 2074e137-1b73-4e2d-88ba-5a3407dbdce0
Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure.
This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=linux category=file_event · 2b5e4d3f-7c9a-4fab-a8d1-3e6f5a7b8c9d
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=macos category=file_event · 2db0458c-05c9-4069-a26f-77becd9c8c13
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. Axios is a popular JavaScript HTTP client.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-03-30 · logsource: product=linux category=process_creation · 36603778-030c-43c4-8cbb-cd3c1d1a80c7
Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8).
In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP.
The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-02-03 (modified 2026-03-16) · logsource: product=windows category=file_event · 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09
Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations.
This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-28 · logsource: product=linux category=process_creation · 514f533b-f56e-421d-80b0-f7706a3e9d23
Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 5299fadf-f228-4526-8274-251db1960be9
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack.
The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-03-30 · logsource: product=linux category=file_event · 81c0b7f5-81c9-435e-a291-bc32fc2b72cd
Detects the creation of specific persistence files as observed in the LiteLLM PyPI supply chain attack.
In March 2026, a supply chain attack was discovered involving the popular open-source LLM framework LiteLLM by Threat Actor TeamPCP.
The malicious package harvests every credential on the system, encrypts and exfiltrates them, and installs a persistent C2 backdoor.
Author: Leonardo Gasparini
· 2026-05-12 · logsource: product=windows category=file_event · 8a3f2c1e-5d7b-4e9a-b6c8-1f2a3d4e5f6a
Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=macos category=process_creation · a09ee860-31b3-4586-8a68-0ebd74ce0e5f
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=linux category=file_event · b7cb840c-11f6-47f7-b3ef-5524739c9077
Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-28 · logsource: product=windows category=process_creation · bae7c70b-8569-44e9-accf-b30073da8a5d
Detects the command-line installation of specific malicious npm packages and versions associated with the Shai-Hulud 2.0 supply chain attack.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-02-03 · logsource: product=windows category=process_creation · bb0e87ce-c89f-4857-84fa-095e4483e9cb
Detects suspicious child process creation by the Notepad++ updater process (gup.exe).
This could indicate potential exploitation of the updater component to deliver unwanted malware.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=windows category=file_event · cd6386fa-bb9a-4b67-b006-786b6ab5d2ba
Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.