Coverage › CVE-2022-20701

CVE-2022-20701 Mapped Sigma

Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability

Vendor / product

Cisco — Small Business RV160, RV260, RV340, and RV345 Series Routers

Description (CISA)

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).

Added to KEV

2022-03-03

Due date

2022-03-17

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

CWE-121

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2022-20701

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1078 Valid Accounts exploitation technique

• DET0560 Detection of Valid Account Abuse Across Platforms
  AN1543 Windows

  Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.

  WinEventLog:Security EventCode=4624 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: LogonType TimeWindow GeoIPMismatch
  AN1544 Linux

  Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Connections sshd or PAM logins → DC0002 User Account Authentication

  Tunable: UserContext HostDensityThreshold LoginMethod
  AN1545 macOS

  Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.

  macos:unifiedlog loginwindow, sshd → DC0088 Logon Session Metadata

  macos:unifiedlog exec logs → DC0032 Process Creation

  Tunable: LoginOrigin ProcessTreeDepth
  AN1546 Identity Provider

  Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.

  saas:okta Sign-in logs / audit events → DC0002 User Account Authentication

  Tunable: MFAFailureCount RiskScoreThreshold IPGeoVelocity
  AN1547 Containers

  Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.

  kubernetes:audit authentication.k8s.io → DC0002 User Account Authentication

  Tunable: ServiceAccountScope ClusterIPWhitelist

Sigma rules tagged attack.t1078 (56)

All 56 rules on the technique page →

T1203 Exploitation for Client Execution primary impact

• DET0287 Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps)
  AN0797 Windows

  Cause→effect chain: (1) A client app (browser, Office, PDF/Flash/reader) experiences a crash/abnormal exit or loads from an unusual location, then (2) drops or modifies a file in user-writable paths, and/or (3) spawns an unexpected child (e.g., powershell/cmd/mshta/rundll32/wscript/installer), and (4) establishes outbound C2-like connections shortly after. Correlate application logs, file writes, process lineage, and network egress within a short window.

  WinEventLog:Application EventCode=1000 → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: TimeWindow HighRiskChildren UserPaths AllowedPlugins EgressAllowlist
  AN0798 Linux

  Cause→effect chain: (1) Browser/Office/reader process logs crash/segfault or abnormal sandbox message, (2) new executable/script/write occurs in $HOME (Downloads, ~/.cache, /tmp), (3) unexpected child like curl/wget/bash/python opens network connections soon after.

  linux:syslog browser/office crash, segfault, abnormal termination → DC0038 Application Log Content

  auditd:SYSCALL open → DC0055 File Access

  auditd:SYSCALL creat → DC0039 File Creation

  auditd:SYSCALL rename,chmod → DC0061 File Modification

  auditd:SYSCALL execve → DC0032 Process Creation

  NetFlow:Flow new outbound connections from exploited process tree → DC0078 Network Traffic Flow

  Tunable: TimeWindow UserPaths HighRiskChildren PackageUpdaters
  AN0799 macOS

  Cause→effect chain: (1) App crash/abnormal termination in unified logs for Safari/Chrome/Office/Preview, (2) new files/scripts in ~/Library, ~/Downloads, /private/var/folders/*, (3) unexpected child (osascript, zsh, bash, curl) spawned by those apps, (4) new outbound connections.

  macos:unifiedlog process crash, abort, code signing violations → DC0038 Application Log Content

  fs:fsevents create/write/rename under user-writable paths → DC0061 File Modification

  macos:osquery exec → DC0032 Process Creation

  NSM:Connections new connections from exploited lineage → DC0078 Network Traffic Flow

  Tunable: TimeWindow HighRiskChildren UserPaths QuarantineBypass

Sigma rules tagged attack.t1203 (35)

All 35 rules on the technique page →