Coverage › CVE-2022-41328

CVE-2022-41328 Mapped Partial Sigma

Fortinet FortiOS Path Traversal Vulnerability

Vendor / product

Fortinet — FortiOS

Description (CISA)

Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.

Added to KEV

2023-03-14

Due date

2023-04-04

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

CWE-22

CISA notes

https://www.fortiguard.com/psirt/FG-IR-22-369
https://nvd.nist.gov/vuln/detail/CVE-2022-41328

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1037 Boot or Logon Initialization Scripts primary impact

• DET0112 Boot or Logon Initialization Scripts Detection Strategy
  AN0311 Windows

  Monitoring modification and execution of user or system logon scripts such as in registry Run keys or startup folders.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Security EventCode=4657 → DC0063 Windows Registry Key Modification

  WinEventLog:TaskScheduler EventCode=106 → DC0001 Scheduled Job Creation

  Tunable: TargetObject ParentProcessName TimeWindow
  AN0312 Linux

  Detection of changes or execution of shell initialization scripts like .bashrc, .profile, or /etc/profile for persistence.

  auditd:SYSCALL EXECVE → DC0032 Process Creation

  auditd:PATH PATH → DC0059 File Metadata

  linux:osquery file_events → DC0061 File Modification

  Tunable: FilePath UserContext TimeWindow
  AN0313 macOS

  Monitoring for modification and execution of login hook scripts or LaunchAgents/LaunchDaemons used for persistence.

  macos:unifiedlog log → DC0029 Script Execution

  fs:fsusage file → DC0055 File Access

  macos:osquery launchd → DC0041 Service Metadata

  Tunable: Label ProgramArguments UserContext
  AN0314 ESXi

  Detection of modification to ESXi rc.local.d or rc scripts that are used to execute on boot.

  esxi:vmkernel boot → DC0029 Script Execution

  esxi:hostd boot → DC0061 File Modification

  Tunable: ScriptName LogSeverity
  AN0315 Network Devices

  Detection of changes to device startup-config files that include boot scripts or scheduled execution routines.

  networkdevice:syslog config → DC0061 File Modification

  Tunable: Interface CommandPattern

Sigma rules tagged attack.t1037 (0)

None. MITRE's strategy above is the only public detection guidance for this technique.

T1049 System Network Connections Discovery secondary impact

• DET0320 Detection of System Network Connections Discovery Across Platforms
  AN0903 Windows

  Detects usage of commands or binaries (e.g., netstat, PowerShell Get-NetTCPConnection) and WMI or API calls to enumerate local or remote network connections.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106 → DC0064 Command Execution

  Tunable: SuspiciousParentProcesses TimeWindow CommandPatternList
  AN0904 Linux

  Detects use of netstat, ss, lsof, or custom shell scripts to list current network connections. Often paired with privilege escalation or staging.

  auditd:SYSCALL execve → DC0032 Process Creation

  linux:cli command logging → DC0064 Command Execution

  Tunable: UtilityNameList UserContextScope ExecutionFrequencyThreshold
  AN0905 macOS

  Detects shell-based enumeration of active connections using netstat, lsof -i, or AppleScript-based system discovery.

  macos:osquery process_events → DC0032 Process Creation

  Tunable: ShellCommandWatchlist TerminalBinaryDenylist
  AN0906 ESXi

  Detects shell or API usage of esxcli network ip connection list or netstat to enumerate ESXi host connections.

  esxi:hostd command log → DC0064 Command Execution

  Tunable: ExecutionOriginCheck ExpectedAdminAccessWindow
  AN0907 Network Devices

  Detects interactive or automated use of CLI commands like show ip sockets, show tcp brief, or SNMP queries for active sessions on routers/switches.

  networkdevice:cli command logs → DC0064 Command Execution

  snmp:trap management queries → DC0021 OS API Execution

  Tunable: CommandPatternList PrivilegedUserCheck
  AN0908 IaaS

  Detects enumeration of cloud network interfaces, VPCs, subnets, or peer connections using CLI or SDKs (e.g., AWS CLI, Azure CLI, GCloud CLI).

  AWS:CloudTrail Describe* or List* API calls → DC0021 OS API Execution

  azure:activity networkInsightsLogs → DC0085 Network Traffic Content

  Tunable: ServicePrincipalAllowlist BurstQueryThreshold

Sigma rules tagged attack.t1049 (9)

T1565.001 Stored Data Manipulation secondary impact

• DET0193 Detection Strategy for Stored Data Manipulation across OS Platforms.
  AN0555 Windows

  Identify unauthorized creation, deletion, or modification of business-critical stored data such as Office documents, database files, and log archives. Detect anomalous processes modifying stored data outside of expected workflows (e.g., non-database processes modifying database files).

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=23 → DC0040 File Deletion

  WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0061 File Modification

  Tunable: MonitoredDirectories AuthorizedProcesses TimeWindow
  AN0556 Linux

  Detect suspicious file creation, modification, or deletion in stored data directories (e.g., /var/lib/mysql/, /var/log/, mail spools). Identify shell commands interacting directly with structured data files instead of legitimate database utilities.

  auditd:SYSCALL open, unlink, rename: File creation or deletion involving critical stored data → DC0039 File Creation

  auditd:SYSCALL write: Modification of structured stored data by suspicious processes → DC0061 File Modification

  Tunable: WatchedPaths CommandExclusions
  AN0557 macOS

  Monitor sensitive data files such as plist-based storage, mail archives, or Office files for unexpected modifications. Detect anomalous processes modifying stored data outside expected update cycles using FSEvents and Unified Logs.

  macos:unifiedlog Unexpected creation or modification of stored data files in protected directories → DC0061 File Modification

  macos:osquery CREATE, DELETE, WRITE: Stored data manipulation attempts by unauthorized processes → DC0040 File Deletion

  Tunable: FileIntegrityBaseline AllowedEditors

Sigma rules tagged attack.t1565.001 (6)

T1574 Hijack Execution Flow exploitation technique

• DET0218 Detection Strategy for Hijack Execution Flow across OS platforms.
  AN0609 Windows

  Unusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Security EventCode=4657 → DC0063 Windows Registry Key Modification

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: ServiceBaseline AllowedDllPaths TimeWindow
  AN0610 Linux

  Adversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.

  auditd:SYSCALL open/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin → DC0061 File Modification

  linux:syslog Service restart with modified executable path → DC0041 Service Metadata

  linux:osquery Process execution with LD_PRELOAD or modified library path → DC0032 Process Creation

  Tunable: MonitoredDirectories EnvVarMonitors
  AN0611 macOS

  Abuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.

  macos:unifiedlog Execution of process with DYLD_INSERT_LIBRARIES set → DC0032 Process Creation

  macos:unifiedlog Modified application plist or binary replacement in /Applications → DC0061 File Modification

  macos:unifiedlog Dylib loaded from abnormal location → DC0016 Module Load

  Tunable: AllowedDylibPaths PlistMonitors

Sigma rules tagged attack.t1574 (8)