Coverage › CVE-2022-22954

CVE-2022-22954 Mapped Sigma

VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

Vendor / product: VMware — Workspace ONE Access and Identity Manager
Description (CISA): VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.
Added to KEV: 2022-04-14
Due date: 2022-05-05
Required action: Apply updates per vendor instructions.
Known ransomware use: Known
CWE: CWE-94
CISA notes: https://nvd.nist.gov/vuln/detail/CVE-2022-22954
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1221 Template Injection	exploitation technique	This vulnerability is exploited via server-side template injection to achieve remote code execution. This access is then used to establish backdoors. Adversaries have been observed chaining this with CVE-2022-22960 in order to escalate privileges to root. ref 1 · ref 2 · ref 3 · ref 4	live
T1505.003 Web Shell	primary impact	This vulnerability is exploited via server-side template injection to achieve remote code execution. This access is then used to establish backdoors. Adversaries have been observed chaining this with CVE-2022-22960 in order to escalate privileges to root. ref 1 · ref 2 · ref 3	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1221 Template Injection exploitation technique

DET0566 Template Injection Detection - Windows
AN1564 Windows
Detection of Office or document viewer processes (e.g., winword.exe) initiating network connections to remote templates or executing scripts due to manipulated template references (e.g., embedded in .docx, .rtf, or .dotm files), followed by suspicious child process creation (e.g., PowerShell).

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: TemplateURLPatterns ParentProcess TimeWindow ChildProcessAnomalyThreshold

Sigma rules tagged `attack.t1221` (2)

Suspicious Set Value of MSDT in Registry (CVE-2022-30190) mediumtest

Author: Sittikorn S · 2020-05-31 (modified 2023-08-17) · logsource: product=windows category=registry_set · 2d9403d5-7927-46b7-8216-37ab7c9ec5e3

Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.

Techniques: T1221

Server Side Template Injection Strings hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-06-14 · logsource: category=webserver · ada3bc4f-f0fd-42b9-ba91-e105e8af7342

Detects SSTI attempts sent via GET requests in access logs

Techniques: T1221

T1505.003 Web Shell primary impact

DET0394 Web Shell Detection via Server Behavior and File Execution Chains
AN1108 Windows
Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)

WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation
NSM:Flow Inbound HTTP POST with suspicious payload size or user-agent → DC0085 Network Traffic Content

Tunable: WebRootPath ParentProcess

AN1109 Linux
File creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx

auditd:SYSCALL new file created in /var/www/html, /srv/http, or similar web root → DC0039 File Creation
auditd:SYSCALL apache2 or nginx spawning sh, bash, or python interpreter → DC0032 Process Creation
NSM:Flow POST requests to .php, .jsp, .aspx files with high entropy body → DC0085 Network Traffic Content

Tunable: WebRootPath PayloadEntropyThreshold TimeWindow

AN1110 macOS
Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www

macos:unifiedlog httpd spawning bash, zsh, python, or osascript → DC0032 Process Creation
auditd:SYSCALL file write operations in /Library/WebServer/Documents → DC0061 File Modification

Tunable: InterpreterName ExecutionParent

Sigma rules tagged `attack.t1505.003` (35)

Suspicious File Write to SharePoint Layouts Directory highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-07-24 · logsource: product=windows category=file_event · 1f0489be-b496-4ddf-b3a9-5900f2044e9c

Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.

Techniques: T1190 T1505.003

Suspicious Process Spawned by CentreStack Portal AppPool highexperimental

Author: Jason Rathbun (Blackpoint Cyber) · 2025-04-17 · logsource: product=windows category=process_creation · 2d79e371-2a27-42de-87a4-b4213fc72a6a

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

Techniques: T1059.003 T1505.003

CVE tags: CVE-2025-30406

Webshell ReGeorg Detection Via Web Logs hightest

Author: Cian Heasley · 2020-08-04 (modified 2023-01-02) · logsource: category=webserver · 2ea44a60-cfda-11ea-87d0-0242ac130003

Certain strings in the uri_query field when combined with null referer and null user agent can indicate activity associated with the webshell ReGeorg.

Techniques: T1505.003

Execution From Webserver Root Folder mediumtest

Author: Florian Roth (Nextron Systems) · 2019-01-16 (modified 2024-01-18) · logsource: product=windows category=process_creation · 35efb964-e6a5-47ad-bbcd-19661854018d

Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors

Techniques: T1505.003

Oracle WebLogic Exploit criticaltest

Author: Florian Roth (Nextron Systems) · 2018-07-22 (modified 2023-01-02) · logsource: category=webserver · 37e8369b-43bb-4bf8-83b6-6dd43bda2000

Detects access to a webshell dropped into a keystore folder on the WebLogic server

Techniques: T1190 T1505.003

CVE tags: CVE-2018-2894

Potential Webshell Creation On Static Website mediumtest

Author: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo · 2019-10-22 (modified 2023-10-15) · logsource: product=windows category=file_event · 39f1f9f2-9636-45de-98f6-a4046aa8e4b9

Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.

Techniques: T1505.003

MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-03 (modified 2023-07-28) · logsource: category=webserver · 435e41f2-48eb-4c95-8a2b-ed24b50ec30b

Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362

Techniques: T1505.003

CVE tags: CVE-2023-34362

Webshell Hacking Activity Patterns hightest

Author: Florian Roth (Nextron Systems) · 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9

Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system

Techniques: T1505.003 T1018 T1033 T1087

Mailbox Export to Exchange Webserver criticaltest

Author: Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems) · 2021-08-09 (modified 2023-04-30) · logsource: product=windows service=msexchange-management · 516376b4-05cd-4122-bae0-ad7641c38d48

Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

Techniques: T1505.003

Potential Java WebShell Upload in SAP NetViewer Server highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-05-14 · logsource: category=webserver · 639b893f-f93a-4e53-a7c8-f08cf73fe7f7

Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.

Techniques: T1505.003

CVE tags: CVE-2025-31324

Suspicious File Drop by Exchange mediumtest

Author: Florian Roth (Nextron Systems) · 2022-10-04 · logsource: product=windows category=file_event · 6b269392-9eba-40b5-acb6-55c882b20ba6

Detects suspicious file type dropped by an Exchange component in IIS

Techniques: T1190 T1505.003

Suspicious MSExchangeMailboxReplication ASPX Write hightest

Author: Florian Roth (Nextron Systems) · 2022-02-25 · logsource: product=windows category=file_event · 7280c9f3-a5af-45d0-916a-bc01cb4151c9

Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation

Techniques: T1190 T1505.003

Windows Webshell Strings hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2017-02-19 (modified 2022-11-18) · logsource: category=webserver · 7ff9db12-1b94-4a79-ba68-a2402c5d6729

Detects common commands used in Windows webshells

Techniques: T1505.003

Linux Webshell Indicators hightest

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-10-15 (modified 2026-08-19) · logsource: product=linux category=process_creation · 818f7b24-0fba-4c49-a073-8b755573b9c7

Detects suspicious sub processes of web server processes

Techniques: T1505.003

Suspicious Process By Web Server Process hightest

Author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) · 2019-01-16 (modified 2024-11-26) · logsource: product=windows category=process_creation · 8202070f-edeb-4d31-a010-a26c72ac5600

Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation

Techniques: T1505.003 T1190

All 35 rules on the technique page →

Sigma rules tagged with this CVE directly

1 rule carries cve.2022-22954.

Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution mediumtest

Author: @kostastsale · 2022-04-25 · logsource: product=windows category=process_creation · 5660d8db-6e25-411f-b92f-094420168a5d

Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.

Techniques: T1059.006 T1190

CVE tags: CVE-2022-22954

CVE-2022-22954 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1221 Template Injection exploitation technique

Sigma rules tagged attack.t1221 (2)

T1505.003 Web Shell primary impact

Sigma rules tagged attack.t1505.003 (35)

Sigma rules tagged with this CVE directly

Sigma rules tagged `attack.t1221` (2)

Sigma rules tagged `attack.t1505.003` (35)