Coverage › CVE-2022-20699

CVE-2022-20699 Mapped Sigma

Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

Vendor / product

Cisco — Small Business RV160, RV260, RV340, and RV345 Series Routers

Description (CISA)

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

Added to KEV

2022-03-03

Due date

2022-03-17

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

CWE-785

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2022-20699

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059.004 Unix Shell primary impact

• DET0384 Behavioral Detection of Unix Shell Execution
  AN1081 Linux

  Detects bash, sh, zsh, or BusyBox shell execution initiated via remote sessions, unauthorized users, or embedded within secondary script interpreters. Focus is on chained behavior: shell > suspicious commands > network discovery or persistence indicators.

  auditd:SYSCALL execve → DC0032 Process Creation

  linux:osquery socket_events → DC0078 Network Traffic Flow

  linux:syslog auth.log / secure.log → DC0067 Logon Session Creation

  Tunable: ExecutableName UserContext ParentProcess TimeWindow CommandLinePattern
  AN1082 macOS

  Identifies use of sh/bash/zsh in suspicious context, such as user scripts launched from non-standard apps (e.g., Preview.app), embedded in LaunchDaemons, or executed outside Terminal.app. Looks for misuse in Automator, LaunchAgents, or NSAppleScript-executed shell.

  macos:unifiedlog log stream --predicate 'eventMessage contains "exec"' → DC0032 Process Creation

  macos:osquery launchd + process_events → DC0064 Command Execution

  macos:syslog system.log, asl.log → DC0029 Script Execution

  Tunable: ScriptLocation ParentProcess UserRole
  AN1083 ESXi

  Detects BusyBox or Ash shell execution from unauthorized logins or remote connections. Focus is on rare shell invocations from DCUI, SSH sessions, or remote management paths. Also watches for payload droppers or persistence artifacts using shell.

  esxi:vmkernel DCUI shell start, BusyBox activity → DC0064 Command Execution

  esxi:auth Shell login or escalation → DC0067 Logon Session Creation

  Tunable: UserContext CommandPattern ShellPath
  AN1084 Network Devices

  Detects Unix shell usage on network appliances (e.g., routers, firewalls, embedded Linux) through rare console commands, CLI interfaces, or script injection via exposed APIs or SSH.

  networkdevice:syslog CLI Command Audit → DC0064 Command Execution

  NSM:Flow remote access → DC0082 Network Connection Creation

  Tunable: Interface CommandString

Sigma rules tagged attack.t1059.004 (18)

All 18 rules on the technique page →

T1133 External Remote Services exploitation technique

• DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
  AN1004 Windows

  Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Application VPN, Citrix, or remote access gateway logs showing external IP addresses → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: BusinessHours KnownRemoteIPs FailedLogonThreshold GeoIPWhitelist TimeWindow
  AN1005 Linux

  Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).

  auditd:SYSCALL ssh logins or execve of remote commands → DC0088 Logon Session Metadata

  NSM:Connections Failed password or accepted password for SSH users → DC0038 Application Log Content

  NSM:Flow connection: Inbound connections to SSH or VPN ports → DC0082 Network Connection Creation

  Tunable: KnownSSHClients FailedLogonThreshold TimeWindow
  AN1006 macOS

  Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.

  macos:unifiedlog Remote login (ssh) or screen sharing authentication attempts → DC0088 Logon Session Metadata

  macos:unifiedlog Inbound connections to VNC/SSH ports → DC0082 Network Connection Creation

  PF:Logs External traffic to remote access services → DC0078 Network Traffic Flow

  Tunable: KnownVNCServers TimeWindow
  AN1007 Containers

  Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.

  ApplicationLog:API Docker/Kubernetes API access from external sources → DC0038 Application Log Content

  kubernetes:audit Unauthorized container creation or kubelet exec logs → DC0088 Logon Session Metadata

  NSM:Flow External access to container ports (2375, 6443) → DC0082 Network Connection Creation

  Tunable: AllowedCIDRs TimeWindow

Sigma rules tagged attack.t1133 (20)

All 20 rules on the technique page →