Coverage › CVE-2022-3038
CVE-2022-3038 Mapped Sigma
Google Chromium Network Service Use-After-Free Vulnerability
- Vendor / product
- Google — Chromium Network Service
- Description (CISA)
- Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Added to KEV
- 2023-03-30
- Due date
- 2023-04-20
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Unknown
- CWE
- CWE-416
- CISA notes
- https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html
https://nvd.nist.gov/vuln/detail/CVE-2022-3038 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1204.001 Malicious Link | exploitation technique | This vulnerability has been exploited by a remote attacker to perform a sandbox escape via a crafted HTML page that allowed the attacker to exploit a heap corruption. This vulnerability was chained together with other CVEs during a spyware campaign performed by a customer or partner of a Spanish spyware company known as Variston IT. ref 1 · ref 2 |
live |
| T1574 Hijack Execution Flow | primary impact | This vulnerability has been exploited by a remote attacker to perform a sandbox escape via a crafted HTML page that allowed the attacker to exploit a heap corruption. This vulnerability was chained together with other CVEs during a spyware campaign performed by a customer or partner of a Spanish spyware company known as Variston IT. ref 1 · ref 2 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1204.001 Malicious Link exploitation technique
- DET0066 User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)
AN0178 WindowsBehavioral chain: (1) a user-facing app (browser/Office/email client) launches a URL or handles a link, then (2) the same process lineage makes an outbound connection to an untrusted domain/IP, (3) a file is downloaded or unpacked to a user-writable location shortly after the click. Optional enrichment: subsequent child execution by LOLBINs.NSM:Flow
Suspicious URL patterns, uncommon TLDs, short-lived domains, URL shorteners; HTTP method GET/POST→ DC0085 Network Traffic ContentTunable:TimeWindowBrowserParentsUserPathsSuspiciousTLDsAllowedCDNsAN0179 LinuxBehavioral chain: (1) browser/office/GUI mail client opens a URL, (2) outbound connection to untrusted domain, (3) a new file is saved in $HOME/Downloads, /tmp, or cache immediately after.auditd:SYSCALLexecve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline→ DC0082 Network Connection Creationauditd:SYSCALLopen,creat,rename: Writes in $HOME/Downloads, /tmp, ~/.cache with exe/script/archive/office extensions→ DC0039 File CreationTunable:TimeWindowUserPathsHighRiskExtensionsDomainRiskScoreAN0180 macOSBehavioral chain: (1) Safari/Chrome/Firefox/Office handles a URL; unified logs show open/click or LSQuarantine assignment, (2) outbound connection to untrusted domain, (3) a new file appears in ~/Downloads or /private/var/folders/* with quarantine flag.NSM:ConnectionsNew outbound connection from Safari/Chrome/Firefox/Word→ DC0082 Network Connection Creationfs:fseventsCreate in /Users/*/Downloads or /private/var/folders/* with quarantine attribute→ DC0039 File CreationTunable:TimeWindowQuarantinePolicySuspiciousTLDs
Sigma rules tagged attack.t1204.001 (4)
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: Florian Roth (Nextron Systems)
· 2019-04-05 (modified 2021-11-27) · logsource: product=linux · c67fc22a-0be5-4b4f-aad5-2b32c4b69523
Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd
Author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-19 · logsource: product=windows category=process_creation · d487ed4a-fd24-436d-a0b2-f4e95f7b2635
Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix).
Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-03-25 (modified 2025-11-19) · logsource: product=windows category=registry_set · f5fe36cf-f1ec-4c23-903d-09a3110f6bbb
Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links.
ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages.
Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content,
such as one-liners that execute remotely hosted malicious files or scripts.
T1574 Hijack Execution Flow primary impact
- DET0218 Detection Strategy for Hijack Execution Flow across OS platforms.
AN0609 WindowsUnusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.Tunable:
ServiceBaselineAllowedDllPathsTimeWindowAN0610 LinuxAdversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.auditd:SYSCALLopen/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin→ DC0061 File ModificationTunable:MonitoredDirectoriesEnvVarMonitorsAN0611 macOSAbuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.macos:unifiedlogModified application plist or binary replacement in /Applications→ DC0061 File ModificationTunable:AllowedDylibPathsPlistMonitors
Sigma rules tagged attack.t1574 (8)
Author: FPT.EagleEye, Thomas Patzke (improvements)
· 2021-06-29 (modified 2022-06-02) · logsource: product=windows category=image_load · 02fb90de-c321-4e63-a6b9-25f4b03dfd14
Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
· 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Author: Florian Roth (Nextron Systems)
· 2019-07-17 (modified 2023-05-24) · logsource: product=windows category=process_creation · 50919691-7302-437f-8e10-1fe088afa145
Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.
Author: Bhabesh Raj
· 2021-07-01 (modified 2023-02-17) · logsource: product=windows category=file_delete · 5b2bbc47-dead-4ef7-8908-0cf73fcbecbf
Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675
Author: frack113
· 2022-08-07 (modified 2023-08-17) · logsource: product=windows category=registry_set · 9827ae57-3802-418f-994b-d5ecf5cd974b
Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes
Author: Ivan Dyachkov, Yulia Fomina, oscd.community
· 2020-10-07 (modified 2021-11-27) · logsource: product=windows category=process_creation · a2910908-e86f-4687-aeba-76a5f996e652
Detects using register-cimprovider.exe to execute arbitrary dll file.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 · logsource: product=windows category=file_event · dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c
Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
Author: Florian Roth (Nextron Systems)
· 2020-07-01 (modified 2023-08-17) · logsource: product=windows category=registry_set · e0813366-0407-449a-9869-a2db1119dc41
Detects a suspicious printer driver installation with an empty Manufacturer value