Coverage › CVE-2022-22960

CVE-2022-22960 Mapped Sigma

VMware Multiple Products Privilege Escalation Vulnerability

Vendor / product

VMware — Multiple Products

Description (CISA)

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.

Added to KEV

2022-04-15

Due date

2022-05-06

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

CWE-250

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2022-22960

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

1 mapping object across 1 technique. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1222 File and Directory Permissions Modification exploitation technique

• DET0299 Multi-Platform File and Directory Permissions Modification Detection Strategy
  AN0834 Windows

  Sequential behavioral chain of privilege escalation through permission modification: (1) Process creation of permission-modifying utilities (icacls, takeown, attrib, cacls), (2) Correlation with unusual user context or timing, (3) DACL modification events targeting sensitive files/directories, (4) Subsequent file access or modification attempts indicating successful privilege bypass

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0059 File Metadata

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0066 Active Directory Object Modification

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

  Tunable: TimeWindow SensitivePathList TrustedUserContext BusinessHoursThreshold
  AN0835 Linux

  Behavioral sequence of unauthorized privilege escalation via permission modification: (1) chmod/chown/setfacl process execution with suspicious parameters, (2) Targeting of critical system files or unusual permission values, (3) Correlation with non-privileged user context or unusual timing patterns, (4) Follow-on file access indicating successful permission bypass

  auditd:SYSCALL syscall in (chmod, fchmod, fchmodat, chown, fchown, fchownat, setxattr, lsetxattr, fsetxattr) → DC0059 File Metadata

  auditd:PROCTITLE proctitle contains chmod, chown, setfacl, or attr commands with suspicious parameters → DC0064 Command Execution

  Tunable: SuspiciousPermissionValues CriticalPathPatterns AuthorizedAdminUsers AnomalyThreshold
  AN0836 macOS

  macOS-specific permission modification behavioral chain: (1) chmod/chown/chflags process execution, (2) System Integrity Protection (SIP) bypass attempts, (3) Extended attribute (xattr) modifications, (4) Unified log correlation with file system events, (5) Subsequent access to previously restricted resources

  macos:unifiedlog process execution events for chmod, chown, chflags with unusual parameters or targets → DC0032 Process Creation

  fs:fsevents file system events indicating permission or attribute changes → DC0059 File Metadata

  Tunable: SIPProtectedPaths SuspiciousFlagCombinations XattrMonitoringScope UnifiedLogRetention
  AN0837 ESXi

  ESXi hypervisor permission modification behavioral chain: (1) SSH access to ESXi host, (2) chmod/chown execution on VMFS datastore files or system configuration, (3) Modification of VM configuration files (.vmx) or virtual disk permissions, (4) Hostd service log correlation, (5) vCenter permission change events if centrally managed

  esxi:shell shell command execution for chmod, chown, or file permission modification on VMFS or system files → DC0064 Command Execution

  esxi:hostd host daemon events related to file or VM permission changes → DC0059 File Metadata

  esxi:vpxd permission change operations on datastores or VMs → DC0066 Active Directory Object Modification

  Tunable: AuthorizedSSHUsers CriticalVMFSPaths ShellAccessTimeWindow vCenterIntegrationScope

Sigma rules tagged attack.t1222 (2)