Coverage › CVE-2022-42475

CVE-2022-42475 Mapped Sigma

Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability

Vendor / product

Fortinet — FortiOS

Description (CISA)

Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.

Added to KEV

2022-12-13

Due date

2023-01-03

Required action

Apply updates per vendor instructions.

Known ransomware use

Known

CWE

CWE-197

CISA notes

https://www.fortiguard.com/psirt/FG-IR-22-398
https://nvd.nist.gov/vuln/detail/CVE-2022-42475

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1071.001 Web Protocols secondary impact

• DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets
  AN0075 Windows

  Detects unexpected or high-volume HTTP/S/WebSocket communication from suspicious processes (e.g., PowerShell, rundll32) using uncommon user agents or mimicking browser traffic to unusual domains or IPs.

  NSM:Flow http.log, ssl.log → DC0085 Network Traffic Content

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: ProcessNameExclusions UserAgentAnomalies OutboundByteRatioThreshold
  AN0076 Linux

  Detects curl, wget, Python requests, or custom HTTP clients communicating over non-standard ports, with repetitive or beacon-like patterns or POST-heavy behavior to rare domains.

  NSM:Flow http.log, conn.log → DC0085 Network Traffic Content

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: CommandLinePatternMatch BeaconIntervalWindow
  AN0077 macOS

  Detects applications such as Automator, AppleScript, or LaunchDaemons invoking HTTP/S traffic to non-standard domains or using suspicious headers (e.g., Base64 in URIs or cookie fields).

  macos:osquery socket_events → DC0078 Network Traffic Flow

  macos:unifiedlog log stream --predicate → DC0064 Command Execution

  Tunable: SuspiciousParentProcess URIEntropyThreshold
  AN0078 ESXi

  Detects HTTP or HTTPS communication initiated by shell-based scripts or management daemons, especially those reaching public IPs over ports 80/443 using embedded curl or wget.

  NSM:Flow SPAN or port-mirrored HTTP/S → DC0085 Network Traffic Content

  esxi:shell /root/.ash_history or /etc/init.d/* → DC0032 Process Creation

  Tunable: ShellScriptMatch ExternalConnectionFilter
  AN0079 Network Devices

  Detects Web protocol misuse such as encoded HTTP headers, WebSocket upgrade requests with abnormal payloads, or TLS handshake anomalies suggesting embedded C2 channels.

  NSM:Flow http.log, ssl.log, websocket.log → DC0085 Network Traffic Content

  Tunable: HeaderEncodingPattern TLSFingerprintMismatch

Sigma rules tagged attack.t1071.001 (42)

All 42 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

• DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
  AN0219 Windows

  Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

  ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList
  AN0220 Linux

  Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

  ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

  Tunable: WebProcList ChildToolList BurstThreshold TimeWindow
  AN0221 macOS

  Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

  macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content

  macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation

  NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

  Tunable: ServiceList TimeWindow
  AN0222 Containers

  Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

  ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content

  docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation

  NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

  Tunable: IngressNamespaces MetadataEndpoints TimeWindow
  AN0223 IaaS

  Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

  ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content

  AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

  Tunable: LBProjects ErrorBurst
  AN0224 ESXi

  Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

  esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content

  NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

  Tunable: MgmtCIDR TimeWindow
  AN0225 Network Devices

  Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

  networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content

  NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

  Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged attack.t1190 (149)

All 149 rules on the technique page →

T1574 Hijack Execution Flow primary impact

• DET0218 Detection Strategy for Hijack Execution Flow across OS platforms.
  AN0609 Windows

  Unusual modifications to service binary paths, registry keys, or DLL load paths resulting in alternate execution flow. Defender observes registry key modifications, suspicious file writes into system directories, and processes loading libraries from abnormal paths.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Security EventCode=4657 → DC0063 Windows Registry Key Modification

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: ServiceBaseline AllowedDllPaths TimeWindow
  AN0610 Linux

  Adversary manipulation of shared library paths, environment variables, or replacement of service binaries. Defender observes suspicious modifications in /etc/ld.so.preload, service config changes, or file writes replacing existing executables.

  auditd:SYSCALL open/write syscalls targeting /etc/ld.so.preload or binaries in /usr/bin → DC0061 File Modification

  linux:syslog Service restart with modified executable path → DC0041 Service Metadata

  linux:osquery Process execution with LD_PRELOAD or modified library path → DC0032 Process Creation

  Tunable: MonitoredDirectories EnvVarMonitors
  AN0611 macOS

  Abuse of DYLD_INSERT_LIBRARIES or hijacking framework paths for malicious libraries. Defender observes processes invoking abnormal dylibs, modified plist files, or persistence entries pointing to altered binaries.

  macos:unifiedlog Execution of process with DYLD_INSERT_LIBRARIES set → DC0032 Process Creation

  macos:unifiedlog Modified application plist or binary replacement in /Applications → DC0061 File Modification

  macos:unifiedlog Dylib loaded from abnormal location → DC0016 Module Load

  Tunable: AllowedDylibPaths PlistMonitors

Sigma rules tagged attack.t1574 (8)

T1622 Debugger Evasion secondary impact

• DET0371 Detection Strategy for Debugger Evasion (T1622)
  AN1045 Windows

  Monitor for suspicious use of Windows API calls such as IsDebuggerPresent() and NtQueryInformationProcess(), or processes manually checking the BeingDebugged flag in the Process Environment Block (PEB). Detect sequences of OutputDebugStringW() calls in short intervals that may indicate debugger flooding attempts.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  etw:Microsoft-Windows-Kernel-Process NtQueryInformationProcess → DC0021 OS API Execution

  Tunable: ApiCallFrequencyThreshold ProcessAllowList
  AN1046 Linux

  Monitor access to /proc/self/status where TracerPID field is queried, as this is a common technique for debugger detection. Detect processes that attempt to trigger exceptions intentionally and monitor whether exception handling indicates presence of a debugger.

  auditd:SYSCALL open/read: Access to /proc/self/status with focus on TracerPID field → DC0055 File Access

  Tunable: MonitoredPaths SyscallThreshold
  AN1047 macOS

  Detect suspicious calls to sysctl or ptrace API used to determine if a process is being debugged. Monitor for processes that flood OutputDebugString equivalents or generate abnormal exceptions to evade analysis.

  macos:unifiedlog ptrace: Processes invoking ptrace with PTRACE_TRACEME flag → DC0021 OS API Execution

  Tunable: PtraceInvocationThreshold DevToolExclusionList

Sigma rules tagged attack.t1622 (1)

Sigma rules tagged with this CVE directly

1 rule carries cve.2022-42475.