Coverage › CVE-2023-21608

CVE-2023-21608 Mapped Sigma

Adobe Acrobat and Reader Use-After-Free Vulnerability

Vendor / product: Adobe — Acrobat and Reader
Description (CISA): Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.
Added to KEV: 2023-10-10
Due date: 2023-10-31
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Unknown
CWE: CWE-416
CISA notes: https://helpx.adobe.com/security/products/acrobat/apsb23-01.html
https://nvd.nist.gov/vuln/detail/CVE-2023-21608
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1204.002 Malicious File	exploitation technique	This vulnerability is exploited by having a user open a maliciously-crafted pdf file, which can result in arbitrary code execution. ref 1	live
T1203 Exploitation for Client Execution	primary impact	This vulnerability is exploited by having a user open a maliciously-crafted pdf file, which can result in arbitrary code execution. ref 1	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1203 Exploitation for Client Execution primary impact

DET0287 Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps)
AN0797 Windows
Cause→effect chain: (1) A client app (browser, Office, PDF/Flash/reader) experiences a crash/abnormal exit or loads from an unusual location, then (2) drops or modifies a file in user-writable paths, and/or (3) spawns an unexpected child (e.g., powershell/cmd/mshta/rundll32/wscript/installer), and (4) establishes outbound C2-like connections shortly after. Correlate application logs, file writes, process lineage, and network egress within a short window.

WinEventLog:Application EventCode=1000 → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: TimeWindow HighRiskChildren UserPaths AllowedPlugins EgressAllowlist

AN0798 Linux
Cause→effect chain: (1) Browser/Office/reader process logs crash/segfault or abnormal sandbox message, (2) new executable/script/write occurs in $HOME (Downloads, ~/.cache, /tmp), (3) unexpected child like curl/wget/bash/python opens network connections soon after.

linux:syslog browser/office crash, segfault, abnormal termination → DC0038 Application Log Content
auditd:SYSCALL open → DC0055 File Access
auditd:SYSCALL creat → DC0039 File Creation
auditd:SYSCALL rename,chmod → DC0061 File Modification
auditd:SYSCALL execve → DC0032 Process Creation
NetFlow:Flow new outbound connections from exploited process tree → DC0078 Network Traffic Flow

Tunable: TimeWindow UserPaths HighRiskChildren PackageUpdaters

AN0799 macOS
Cause→effect chain: (1) App crash/abnormal termination in unified logs for Safari/Chrome/Office/Preview, (2) new files/scripts in ~/Library, ~/Downloads, /private/var/folders/*, (3) unexpected child (osascript, zsh, bash, curl) spawned by those apps, (4) new outbound connections.

macos:unifiedlog process crash, abort, code signing violations → DC0038 Application Log Content
fs:fsevents create/write/rename under user-writable paths → DC0061 File Modification
macos:osquery exec → DC0032 Process Creation
NSM:Connections new connections from exploited lineage → DC0078 Network Traffic Flow

Tunable: TimeWindow HighRiskChildren UserPaths QuarantineBypass

Sigma rules tagged `attack.t1203` (35)

Download From Suspicious TLD - Blacklist lowtest

Author: Florian Roth (Nextron Systems) · 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19

Detects download of certain file types from hosts in suspicious TLDs

Suspicious HWP Sub Processes hightest

Author: Florian Roth (Nextron Systems) · 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Techniques: T1566.001 T1203 T1059.003

Suspicious Browser Child Process - MacOS mediumtest

Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

Techniques: T1189 T1203 T1059

Antivirus - APT Malware Signature criticalexperimental

Author: Arnim Rupp (Nextron Systems) · 2026-06-15 · logsource: category=antivirus · 101a1877-2cf4-474d-abfd-7f6ac4788d1a

Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Techniques: T1203 T1219.002

Potentially Suspicious Child Process Of WinRAR.EXE mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-08-31 · logsource: product=windows category=process_creation · 146aace8-9bd6-42ba-be7a-0070d8027b76

Detects potentially suspicious child processes of WinRAR.exe.

Techniques: T1203

OMIGOD SCX RunAsProvider ExecuteShellCommand hightest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Techniques: T1068 T1190 T1203

Antivirus - Exploitation Framework Signature criticalstable

Author: Florian Roth (Nextron Systems), Arnim Rupp · 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 238527ad-3c2c-4e4f-a1f6-92fd63adb864

Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Techniques: T1203 T1219.002

Suspicious Invocation of Shell via Rsync highexperimental

Author: Florian Roth · 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594

Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

Techniques: T1059 T1203

CVE-2021-31979 CVE-2021-33771 Exploits criticaltest

Author: Sittikorn S, frack113 · 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Techniques: T1566 T1203

CVE tags: CVE-2021-33771CVE-2021-31979

Dfsvc.EXE Network Connection To Non-Local IPs mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-12 (modified 2024-03-12) · logsource: product=windows category=network_connection · 3c21219b-49b5-4268-bce6-c914ed50f09c

Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs

Techniques: T1203

Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-05-20 · logsource: category=webserver · 41956f7c-7a6b-46d6-b6bb-da6eb2e83fbe

Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.

Techniques: T1190 T1203

CVE tags: CVE-2025-4427CVE-2025-4428

Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process highexperimental

Author: Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-10-31 · logsource: product=windows category=process_creation · 43259cc4-1b80-4931-bd98-baea01afc196

Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.

Techniques: T1190 T1203

CVE tags: CVE-2025-59287

Audit CVE Event criticaltest

Author: Florian Roth (Nextron Systems), Zach Mathis · 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Techniques: T1203 T1068 T1211 T1212 T1210 T1499.004

Dfsvc.EXE Initiated Network Connection Over Uncommon Port hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-12 (modified 2024-01-31) · logsource: product=windows category=network_connection · 4c5fba4a-9ef6-4f16-823d-606246054741

Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.

Techniques: T1203

Shai-Hulud Malicious Bun Execution highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=windows category=process_creation · 5299fadf-f228-4526-8274-251db1960be9

Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.

Techniques: T1195.002 T1203

All 35 rules on the technique page →

T1204.002 Malicious File exploitation technique

DET0294 User Execution – Malicious File via download/open → spawn chain (T1204.002)
AN0819 Windows
User opens a file delivered by email, web, chat, or share. The handler application (Word/PDF reader/archiver) creates a file in user-controlled paths (Downloads, Temp, Desktop) and then spawns a new or unusual child process (e.g., powershell.exe, wscript.exe, cmd.exe, regsvr32.exe, rundll32.exe, msiexec.exe). Optional precursors include FileStreamCreated (URL/UNC) and Office → system32 batch writes.

WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

Tunable: TimeWindow SuspiciousExtensions UserPaths ParentApps SignerAllowList

AN0820 macOS
User opens a downloaded document/installer leading to EndpointSecurity file create in ~/Downloads or ~/Library paths then an exec of a suspicious utility (osascript, bash/zsh, curl, chmod, open with -a Terminal). Correlates File Creation with subsequent process exec and, optionally, quarantine/LSQuarantine events.

macos:unifiedlog process_exec: image in {/bin/bash,/bin/zsh,/usr/bin/osascript,/usr/bin/python*,/usr/bin/curl,/usr/bin/ssh,/usr/bin/open} AND parent in {Preview, TextEdit, Microsoft Word, Microsoft Excel, AdobeReader, Archive Utility, Finder} → DC0032 Process Creation
macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_CREATE: path under /Users/*/(Downloads|Desktop|Library/*/Containers|Library/Group Containers) AND extension in SuspiciousExtensions → DC0039 File Creation

Tunable: TimeWindow QuarantineRequired ParentApps

AN0821 Linux
User or desktop application writes a new file to ~/Downloads, /tmp, or mounted removable media followed by execve of a risky interpreter/loader (bash, sh, python, perl, php, node, curl|wget piping to sh, ld.so, rdesktop, xdg-open - with unusual args). Uses auditd PATH+SYSCALL (open/creat/write/rename) with execve event linking.

auditd:SYSCALL open/create/rename: name in (/home/*/Downloads/*|/tmp/*|/run/user/*|/media/*) AND ext in SuspiciousExtensions → DC0039 File Creation
auditd:SYSCALL execve: exe in {/bin/bash,/bin/sh,/usr/bin/python*,/usr/bin/perl,/usr/bin/php,/usr/bin/node,/usr/bin/curl,/usr/bin/wget,/usr/bin/xdg-open,/usr/bin/ssh,/usr/bin/rundll32 (wine)} AND ppid process is a document viewer/browser → DC0032 Process Creation

Tunable: TimeWindow DesktopParentMap

Sigma rules tagged `attack.t1204.002` (39)

Download From Suspicious TLD - Blacklist lowtest

Author: Florian Roth (Nextron Systems) · 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19

Detects download of certain file types from hosts in suspicious TLDs

Techniques: T1566 T1203 T1204.002

Potential Suspicious Browser Launch From Document Reader Process mediumtest

Author: Joseph Kamau · 2024-05-27 (modified 2025-10-07) · logsource: product=windows category=process_creation · 1193d960-2369-499f-a158-7b50a31df682

Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.

Techniques: T1204.002

Microsoft Word Add-In Loaded lowtest

Author: Steffen Rogge (dr0pd34d) · 2024-07-10 · logsource: product=windows category=image_load · 1337afba-d17d-4d23-bd55-29b927603b30

Detects Microsoft Word loading an Add-In (.wll) file which can be used by threat actors for initial access or persistence.

Techniques: T1204.002

Suspicious Outlook Child Process hightest

Author: Michael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team · 2022-02-28 (modified 2023-02-04) · logsource: product=windows category=process_creation · 208748f7-881d-47ac-a29c-07ea84bf691d

Detects a suspicious process spawning from an Outlook process.

Techniques: T1204.002

Suspicious Startup Folder Persistence hightest

Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) · 2022-08-10 (modified 2025-10-12) · logsource: product=windows category=file_event · 28208707-fe31-437f-9a7f-4b1108b94d2e

Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.

Techniques: T1204.002 T1547.001

Successful MSIX/AppX Package Installation lowexperimental

Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-03 · logsource: product=windows service=appxdeployment-server · 289dfa9e-e378-4a56-a9d4-7ed5ee218029

Detects successful MSIX/AppX package installations on Windows systems by monitoring EventID 854 in the Microsoft-Windows-AppXDeployment-Server/Operational log. While most installations are legitimate, this can help identify unauthorized or suspicious package installations. It is crucial to monitor such events as threat actors may exploit MSIX/AppX packages to deliver and execute malicious payloads.

Techniques: T1204.002

Potential Maze Ransomware Activity criticaltest

Author: Florian Roth (Nextron Systems) · 2020-05-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 29fd07fc-9cfd-4331-b7fd-cc18dfa21052

Detects specific process characteristics of Maze ransomware word document droppers

Techniques: T1204.002 T1047 T1490

TanStack Supply-Chain Attack Execution Indicators - Linux highexperimental

Author: Leonardo Gasparini · 2026-05-12 · logsource: product=linux category=process_creation · 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026. The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.

Techniques: T1059.007 T1059.006 T1204.002

AppLocker Prevented Application or Script from Running mediumtest

Author: Pushkarev Dmitry · 2020-06-28 (modified 2025-12-03) · logsource: product=windows service=applocker · 401e5d00-b944-11ea-8f9a-00163ecd60ae

Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

Techniques: T1204.002 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007

Suspicious Microsoft Office Child Process hightest

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io · 2018-04-06 (modified 2023-04-24) · logsource: product=windows category=process_creation · 438025f9-5856-4663-83f7-52f878a70a50

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Techniques: T1047 T1204.002 T1218.010

Flash Player Update from Suspicious Location hightest

Author: Florian Roth (Nextron Systems) · 2017-10-25 (modified 2022-08-08) · logsource: category=proxy · 4922a5dd-6743-4fc2-8e81-144374280997

Detects a flashplayer update from an unofficial location

Techniques: T1189 T1204.002 T1036.005

AppLocker Application Would Have Been Blocked mediumexperimental

Author: heyyanu · 2026-03-26 · logsource: product=windows service=applocker · 557e3bd3-7f21-495d-8d50-7c8bdfb8041c

Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.

Techniques: T1204.002 T1059.001 T1059.003 T1059.005 T1059.006 T1059.007

New Application in AppCompat informationaltest

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-05-02 (modified 2023-08-17) · logsource: product=windows category=registry_set · 60936b49-fca0-4f32-993d-7415edcf9a5d

A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

Techniques: T1204.002

Droppers Exploiting CVE-2017-11882 criticalstable

Author: Florian Roth (Nextron Systems) · 2017-11-23 (modified 2021-11-27) · logsource: product=windows category=process_creation · 678eb5f4-8597-4be6-8be7-905e4234b53a

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Techniques: T1203 T1204.002 T1566.001

CVE tags: CVE-2017-11882

Suspicious Microsoft Office Child Process - MacOS hightest

Author: Sohan G (D4rkCiph3r) · 2023-01-31 (modified 2023-02-04) · logsource: product=macos category=process_creation · 69483748-1525-4a6c-95ca-90dc8d431b68

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Techniques: T1059.002 T1137.002 T1204.002

All 39 rules on the technique page →

CVE-2023-21608 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1203 Exploitation for Client Execution primary impact

Sigma rules tagged attack.t1203 (35)

T1204.002 Malicious File exploitation technique

Sigma rules tagged attack.t1204.002 (39)

Sigma rules tagged `attack.t1203` (35)

Sigma rules tagged `attack.t1204.002` (39)