Coverage › CVE-2022-23131

CVE-2022-23131 Mapped Sigma

Zabbix Frontend Authentication Bypass Vulnerability

Vendor / product

Zabbix — Frontend

Description (CISA)

Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.

Added to KEV

2022-02-22

Due date

2022-03-08

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

CWE-290

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2022-23131

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059 Command and Scripting Interpreter secondary impact

• DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
  AN1428 Windows

  Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: CommandLinePattern ParentProcessName TimeWindow
  AN1429 Linux

  Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: InterpreterName UserContext ExecutionChainLength
  AN1430 macOS

  Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

  macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

  Tunable: LaunchAgentName ScriptName TerminalAppUsage
  AN1431 ESXi

  Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

  esxi:vobd shell session start → DC0064 Command Execution

  Tunable: ShellEnabledFlag SSHContext
  AN1432 Network Devices

  Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

  networkdevice:cli shell command → DC0064 Command Execution

  networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

  Tunable: UserRole DeviceType

Sigma rules tagged attack.t1059 (95)

All 95 rules on the technique page →

T1078 Valid Accounts secondary impact

• DET0560 Detection of Valid Account Abuse Across Platforms
  AN1543 Windows

  Detection of compromised or misused valid accounts via anomalous logon patterns, abnormal logon types, and inconsistent geographic or time-based activity across Windows endpoints.

  WinEventLog:Security EventCode=4624 → DC0067 Logon Session Creation

  WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: LogonType TimeWindow GeoIPMismatch
  AN1544 Linux

  Detection of valid account misuse through SSH logins, sudo/su abuse, and service account anomalies outside expected patterns.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Connections sshd or PAM logins → DC0002 User Account Authentication

  Tunable: UserContext HostDensityThreshold LoginMethod
  AN1545 macOS

  Detection of interactive and remote logins by service accounts or users at unusual times, with unexpected child process activity.

  macos:unifiedlog loginwindow, sshd → DC0088 Logon Session Metadata

  macos:unifiedlog exec logs → DC0032 Process Creation

  Tunable: LoginOrigin ProcessTreeDepth
  AN1546 Identity Provider

  Detection of valid account abuse in IdP logs via geographic anomalies, impossible travel, risky sign-ins, and multiple MFA attempts or failures.

  saas:okta Sign-in logs / audit events → DC0002 User Account Authentication

  Tunable: MFAFailureCount RiskScoreThreshold IPGeoVelocity
  AN1547 Containers

  Detection of containerized service accounts or compromised kubeconfigs being used for cluster access from unexpected nodes or IPs.

  kubernetes:audit authentication.k8s.io → DC0002 User Account Authentication

  Tunable: ServiceAccountScope ClusterIPWhitelist

Sigma rules tagged attack.t1078 (56)

All 56 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

• DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
  AN0219 Windows

  Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

  ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList
  AN0220 Linux

  Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

  ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

  Tunable: WebProcList ChildToolList BurstThreshold TimeWindow
  AN0221 macOS

  Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

  macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content

  macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation

  NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

  Tunable: ServiceList TimeWindow
  AN0222 Containers

  Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

  ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content

  docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation

  NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

  Tunable: IngressNamespaces MetadataEndpoints TimeWindow
  AN0223 IaaS

  Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

  ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content

  AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

  Tunable: LBProjects ErrorBurst
  AN0224 ESXi

  Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

  esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content

  NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

  Tunable: MgmtCIDR TimeWindow
  AN0225 Network Devices

  Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

  networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content

  NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

  Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged attack.t1190 (149)

All 149 rules on the technique page →

T1548 Abuse Elevation Control Mechanism primary impact

• DET0345 Detection Strategy for Abuse Elevation Control Mechanism (T1548)
  AN0975 Windows

  Correlate registry modifications (e.g., UAC bypass registry keys), unusual parent-child process relationships (e.g., control.exe spawning cmd.exe), and unsigned elevated process executions with non-standard tokens or elevation flags.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

  Tunable: ElevatedProcessPath ParentProcessName TimeWindow
  AN0976 Linux

  Monitor audit logs for setuid/setgid bit changes, executions where UID ≠ EUID (indicative of sudo or privilege escalation), and high-integrity binaries launched by unprivileged users.

  auditd:SYSCALL setuid or setgid bit changes → DC0059 File Metadata

  auditd:SYSCALL execve with UID ≠ EUID → DC0034 Process Metadata

  auditd:SYSCALL sudo or pkexec invocation → DC0021 OS API Execution

  Tunable: WatchedDirectories UserContext TimeWindow
  AN0977 macOS

  Detect execution of /usr/libexec/security_authtrampoline or use of AuthorizationExecuteWithPrivileges API, and monitor process lineage for unusual launches of GUI apps with escalated privileges.

  macos:unifiedlog authorization execute privilege requests → DC0021 OS API Execution

  auditd:SYSCALL execve with escalated privileges → DC0034 Process Metadata

  fs:fsusage binary execution of security_authtrampoline → DC0032 Process Creation

  Tunable: WatchedBinaries ExecutionParent
  AN0978 Identity Provider

  Monitor for unexpected privilege elevation operations via SAML assertion manipulation, role injection, or changes to identity mappings that result in access escalation.

  azure:signinlogs unusual role assumption or elevation path → DC0010 User Account Modification

  Tunable: AuthorizedRoleMappings TimeWindow
  AN0979 IaaS

  Detect sudden privilege escalations such as IAM role changes, user-assigned privilege boundaries, or elevation via assumed roles beyond normal behavior.

  AWS:CloudTrail role privilege expansion detected → DC0010 User Account Modification

  AWS:CloudTrail cross-account or unexpected assume role → DC0034 Process Metadata

  Tunable: PermittedRoleTransitions CrossAccountBoundary

Sigma rules tagged attack.t1548 (24)

All 24 rules on the technique page →