Coverage › CVE-2025-25181

CVE-2025-25181 Mapped Sigma

Advantive VeraCore SQL Injection Vulnerability

Vendor / product

Advantive — VeraCore

Description (CISA)

Advantive VeraCore contains a SQL injection vulnerability in timeoutWarning.asp that allows a remote attacker to execute arbitrary SQL commands via the PmSess1 parameter.

Added to KEV

2025-03-10

Due date

2025-03-31

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-89

CISA notes

https://advantive.my.site.com/support/s/article/Veracore-Release-Notes-2025-1-1-3
https://nvd.nist.gov/vuln/detail/CVE-2025-25181

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1055 Process Injection exploitation technique

• DET0508 Behavioral Detection of Process Injection Across Platforms
  AN1399 Windows

  Detects process injection by correlating memory manipulation API calls (e.g., VirtualAllocEx, WriteProcessMemory), suspicious thread creation (e.g., CreateRemoteThread), and unusual DLL loads within another process's context.

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  etw:Microsoft-Windows-Kernel-Process API calls → DC0021 OS API Execution

  Tunable: AccessMask TimeWindow InjectedProcessList
  AN1400 Linux

  Detects ptrace- or memfd-based process injection through audit logs capturing system calls (e.g., ptrace, mmap) targeting running processes along with suspicious file descriptors or memory writes.

  auditd:SYSCALL ptrace, mmap, process_vm_writev → DC0021 OS API Execution

  auditd:SYSCALL open → DC0055 File Access

  linux:procfs /proc/[pid]/maps, /proc/[pid]/mem → DC0020 Process Modification

  Tunable: TargetPIDThreshold TimeWindow
  AN1401 macOS

  Detects memory-based injection by monitoring task_for_pid, mach_vm_write, and dylib injection patterns through DYLD_INSERT_LIBRARIES or manual memory mapping.

  macos:unifiedlog subsystem=com.apple.security, library=libsystem_kernel.dylib → DC0035 Process Access

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC, ES_EVENT_TYPE_NOTIFY_MMAP → DC0034 Process Metadata

  macos:syslog DYLD_INSERT_LIBRARIES anomalies → DC0016 Module Load

  Tunable: TargetProcessSignature MachSyscallContext

Sigma rules tagged attack.t1055 (37)

All 37 rules on the technique page →

T1068 Exploitation for Privilege Escalation exploitation technique

• DET0514 Detection Strategy for Exploitation for Privilege Escalation
  AN1419 Windows

  Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

  WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  Tunable: DriverNamePattern TimeWindow ParentProcessPath
  AN1420 Linux

  Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL ACCESS → DC0035 Process Access

  auditd:SYSCALL dmesg → DC0016 Module Load

  Tunable: SetUIDBinaryList TimeWindow EffectiveUIDThreshold
  AN1421 macOS

  Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

  macos:unifiedlog process:exec and kext load events → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD → DC0016 Module Load

  Tunable: EntitlementList TimeWindow
  AN1422 Containers

  Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

  auditd:SYSCALL capset or setns → DC0067 Logon Session Creation

  containerd:runtime e.g., containerd, Docker events → DC0091 Container Enumeration

  Tunable: NamespaceEscapePattern TimeWindow

Sigma rules tagged attack.t1068 (31)

All 31 rules on the technique page →

T1485 Data Destruction primary impact

• DET0146 Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns
  AN0411 Windows

  Adversary spawns command-line tools (e.g., del, cipher /w, SDelete) or scripts to recursively delete or overwrite user/system files. This may be correlated with abnormal file IO activity, registry writes, or tampering in critical system directories.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=23 → DC0040 File Deletion

  Tunable: TargetFilename ProcessCommandLine VolumeThreshold TimeWindow
  AN0412 Linux

  Massive recursive deletions or overwrites via rm -rf, shred, dd, or wiper binaries. May include unlink syscalls, deletion of known config/data paths, or sequential overwrite patterns.

  auditd:SYSCALL unlink, unlinkat, openat, write → DC0040 File Deletion

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: ExecutablePath DeletedPathPattern SyscallBurstRate
  AN0413 macOS

  Destruction via rm -rf, overwrite with dd or srm, often executed by script in /tmp or /private/tmp, may also involve file overwrite to political or decoy image data.

  macos:unifiedlog exec rm -rf|dd if=/dev|srm|file unlink → DC0040 File Deletion

  macos:unifiedlog process.*exit.*code → DC0033 Process Termination

  Tunable: CommandPattern EntropyChangeRate
  AN0414 IaaS

  Adversary deletes critical infrastructure: EC2 instances, S3 buckets, snapshots, or volumes using elevated IAM credentials. Frequently includes batch API calls with Delete* or TerminateInstances.

  AWS:CloudTrail DeleteBucket, DeleteDBCluster, DeleteSnapshot, TerminateInstances → DC0022 Cloud Storage Deletion

  Tunable: OperationType UserAgent RegionScope
  AN0415 ESXi

  Adversary destroys virtual disks (VMDK), images, or VMs by invoking vim-cmd, deleting datastore contents, or purging snapshots.

  esxi:vmkernel file delete|datastore purge → DC0098 Volume Deletion

  Tunable: DatastorePath InitiatingUser
  AN0416 Containers

  Container process executes destructive file operations inside volume mounts or host paths. Includes rm -rf /mnt/volumes/, container breakout followed by host deletion attempts.

  auditd:SYSCALL unlink, unlinkat, rmdir → DC0040 File Deletion

  docker:events container exec rm|container stop --force → DC0064 Command Execution

  Tunable: MountPoint ContainerImage

Sigma rules tagged attack.t1485 (20)

All 20 rules on the technique page →