Coverage › CVE-2023-40044

CVE-2023-40044 Mapped Partial Sigma

Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

Vendor / product

Progress — WS_FTP Server

Description (CISA)

Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.

Added to KEV

2023-10-05

Due date

2023-10-26

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Known

CWE

CWE-502

CISA notes

https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
https://nvd.nist.gov/vuln/detail/CVE-2023-40044

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059 Command and Scripting Interpreter exploitation technique

• DET0516 Behavioral Detection of Command and Scripting Interpreter Abuse
  AN1428 Windows

  Detects the execution of scripting or command interpreters (e.g., powershell.exe, cmd.exe, wscript.exe) outside expected administrative time windows or from abnormal user contexts, often followed by encoded/obfuscated arguments or secondary execution events.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: CommandLinePattern ParentProcessName TimeWindow
  AN1429 Linux

  Detects use of shell interpreters (e.g., bash, sh, python, perl) initiated by users or processes not normally executing them, especially when chaining suspicious utilities like netcat, curl, or ssh.

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: InterpreterName UserContext ExecutionChainLength
  AN1430 macOS

  Detects launch of command-line interpreters via Terminal, Automator, or hidden osascript, especially when parent process lineage deviates from user-initiated applications.

  macos:unifiedlog log stream --info --predicate 'eventMessage CONTAINS "exec"' → DC0032 Process Creation

  Tunable: LaunchAgentName ScriptName TerminalAppUsage
  AN1431 ESXi

  Detects use of 'esxcli system' or direct interpreter commands (e.g., busybox shell) invoked from SSH or host terminal unexpectedly.

  esxi:vobd shell session start → DC0064 Command Execution

  Tunable: ShellEnabledFlag SSHContext
  AN1432 Network Devices

  Identifies CLI interpreter access (e.g., Cisco IOS, Juniper JUNOS) via enable mode or scripting-capable sessions used by uncommon accounts or from unknown IPs.

  networkdevice:cli shell command → DC0064 Command Execution

  networkdevice:syslog authentication & authorization → DC0002 User Account Authentication

  Tunable: UserRole DeviceType

Sigma rules tagged attack.t1059 (95)

All 95 rules on the technique page →

T1071.002 File Transfer Protocols primary impact

• DET0416 Detection of File Transfer Protocol-Based C2 (FTP, FTPS, SMB, TFTP)
  AN1169 Windows

  Detects FTP, SMB, or TFTP traffic initiated by suspicious processes like PowerShell, cmd.exe, or rundll32.exe—especially with large outbound file transfers or unbalanced traffic volume.

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  NSM:Flow ftp.log, smb_files.log → DC0085 Network Traffic Content

  Tunable: ProcessImageFilter DataFlowDirectionThreshold FilenamePattern
  AN1170 Linux

  Detects usage of FTP, SCP, or TFTP by non-interactive shells or automation scripts transferring large data volumes to untrusted IPs.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow ftp.log, conn.log → DC0085 Network Traffic Content

  Tunable: TransferSizeThreshold CommandLinePatternMatch
  AN1171 macOS

  Detects Automator, AppleScript, or Terminal executing curl, lftp, or TFTP for binary transfer to untrusted IPs or unusual ports.

  macos:osquery socket_events → DC0078 Network Traffic Flow

  macos:unifiedlog log stream --predicate → DC0064 Command Execution

  Tunable: FilePathAccessed NetworkPortAnomaly
  AN1172 ESXi

  Detects file movement or outbound TFTP/FTP transfers from ESXi host initiated via shell commands or injected scripts, particularly from scratch partitions or /tmp.

  esxi:shell /root/.ash_history → DC0064 Command Execution

  NSM:Flow mirror/SPAN port → DC0085 Network Traffic Content

  Tunable: TransferTargetDomainOrIP SourceDirectoryFilter
  AN1173 Network Devices

  Detects internal hosts generating large outbound FTP/TFTP/SMB sessions to external IPs, or file transfers using non-standard ports and application mismatches (e.g., FTP over port 80).

  NSM:Flow ftp.log, conn.log, smb_files.log → DC0085 Network Traffic Content

  Tunable: AppLayerProtocolMatch OutboundDataRateThreshold

Sigma rules tagged attack.t1071.002 (0)

None. MITRE's strategy above is the only public detection guidance for this technique.

T1202 Indirect Command Execution secondary impact

• DET0200 Indirect Command Execution – Windows utility abuse behavior chain
  AN0576 Windows

  Cause→effect chain: (1) A user or service launches an indirection utility (e.g., forfiles.exe, pcalua.exe, wsl.exe, scriptrunner.exe, ssh.exe with -o ProxyCommand/LocalCommand). (2) That utility spawns a secondary program/command (PowerShell, cmd, msiexec, regsvr32, curl, arbitrary EXE) and/or opens outbound network connections. (3) Optional precursor modification of SSH config to persist LocalCommand/ProxyCommand. Correlate process creation, command/script content, file access to %USERPROFILE%\.ssh\config, and network connections from the utility or its child.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  Tunable: TimeWindow AllowedUtilities HighRiskChildren UserContext DestCIDRs

Sigma rules tagged attack.t1202 (40)

All 40 rules on the technique page →