18. 05. 2022 Massimo Giaimo Blue Team

Correlation Between the Most Exploited CVEs and Detection Rules

On May 12th, the CSIRT (Computer Security Incident Response Team – Italia) published a list of the CVEs most exploited by threat actors. The list also contains an indication of the TTPs used by these attackers. The objective of this article is to make information available relating to detection rules that are already available within the SIGMA Rules project, in order to identify in a timely manner attempts to exploit the vulnerabilities themselves. Our Security Operation Center Attacker-Centric team will periodically update this page when new detection rules are announced.

Vendor	Product	CVE ID	CVSS	Severity	ATT&CK Tactic	ATT&CK Technique	Detection Rule
Apache	Log4j	CVE-2021-44228	10.0	CRITICAL	Lateral Movement Initial Access	Exploit Public-Facing Application Exploitation of Remote Services	https://github.com/SigmaHQ/sigma/blob/master/rules/web/web_cve_2021_44228_log4j.yml https://github.com/SigmaHQ/sigma/blob/master/rules/web/web_cve_2021_44228_log4j_fields.yml
Cisco	RV320/RV325 Router	CVE-2019-1653	7.5	HIGH	Initial Access	Exploit Public-Facing Application
Citrix	Gateway	CVE-2019-19781	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application	https://github.com/SigmaHQ/sigma/blob/master/rules/web/web_citrix_cve_2019_19781_exploit.yml
Citrix	Application Delivery Controller	CVE-2019-19781	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application	https://github.com/SigmaHQ/sigma/blob/master/rules/web/web_citrix_cve_2019_19781_exploit.yml
Exim	Exim Internet Mailer	CVE-2019-10149	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application
F5	Big-IP	CVE-2020-5902	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application	https://github.com/SigmaHQ/sigma/blob/master/rules/web/web_cve_2020_5902_f5_bigip.yml
Fortinet	FortiOS	CVE-2018-13379	9.1	CRITICAL	Initial Access	Exploit Public-Facing Application External Remote Services	https://github.com/SigmaHQ/sigma/blob/master/rules/web/web_fortinet_cve_2018_13379_preauth_read_exploit.yml
Fortinet	FortiOS	CVE-2018-13374	8.8	HIGH	Initial Access	Exploit Public-Facing Application
Apple	iOS	CVE-2021-1879	6.1	MEDIUM	Execution	Exploitation for Client Execution
Elastic	Kibana	CVE-2019-7609	10.0	CRITICAL	Initial Access	Exploit Public-Facing Application
Linux	Kernel	CVE-2016-0728	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Exchange Server	CVE-2020-0688	8.8	HIGH	Initial Access	Exploit Public-Facing Application	https://github.com/SigmaHQ/sigma/blob/master/rules/web/web_exchange_cve_2020_0688_exploit.yml https://github.com/SigmaHQ/sigma/blob/master/rules/web/web_cve_2020_0688_msexchange.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/win_vul_cve_2020_0688.yml
Microsoft	Exchange Server	CVE-2020-17144	8.4	HIGH	Initial Access	Exploit Public-Facing Application
Microsoft	Exchange Server	CVE-2021-26855	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application
Microsoft	Exchange Server	CVE-2021-26857	7.8	HIGH	Initial Access	Exploit Public-Facing Application	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cve_2021_26857_msexchange.yml
Microsoft	Exchange Server	CVE-2021-26858	7.8	HIGH	Initial Access	Exploit Public-Facing Application	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/file_event_win_cve_2021_26858_msexchange.yml
Microsoft	Exchange Server	CVE-2021-27065	7.8	HIGH	Initial Access	Exploit Public-Facing Application
Microsoft	Office	CVE-2017-0262	7.8	HIGH	Execution	Exploitation for Client Execution	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_exploit_cve_2017_0261.yml
Microsoft	Office	CVE-2017-0199	7.8	HIGH	Execution	Exploitation for Client Execution
Microsoft	Office	CVE-2017-11882	7.8	HIGH	Execution	Exploitation for Client Execution	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_exploit_cve_2017_11882.yml
Microsoft	SQL Server	CVE-2021-1636	8.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2021-34527	8.8	HIGH	Privilege Escalation	Boot or Logon Autostart Execution Exploitation of Remote Services	https://github.com/SigmaHQ/sigma/blob/master/rules/application/antivirus/av_printernightmare_cve_2021_34527.yml https://github.com/SigmaHQ/sigma/blob/master/rules/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dce_rpc_printnightmare_print_driver_install.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_exploit_cve_2021_1675_printspooler_security.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_mimikatz_printernightmare.yml
Microsoft	Windows	CVE-2020-0796	10.0	CRITICAL	Initial Access	Exploit Public-Facing Application
Microsoft	Windows	CVE-2017-0143	8.1	HIGH	Lateral Movement Initial Access	Exploit Public-Facing Application Exploitation of Remote Services
Microsoft	Windows	CVE-2017-0144	8.1	HIGH	Lateral Movement Initial Access	Exploit Public-Facing Application Exploitation of Remote Services
Microsoft	Windows	CVE-2017-0145	8.1	HIGH	Lateral Movement Initial Access	Exploit Public-Facing Application Exploitation of Remote Services
Microsoft	Windows	CVE-2017-0146	8.1	HIGH	Lateral Movement Initial Access	Exploit Public-Facing Application Exploitation of Remote Services
Microsoft	Windows	CVE-2017-0147	5.9	MEDIUM	Lateral Movement Initial Access	Exploit Public-Facing Application Exploitation of Remote Services
Microsoft	Windows	CVE-2017-0148	8.1	HIGH	Lateral Movement Initial Access	Exploit Public-Facing Application Exploitation of Remote Services
Microsoft	Windows	CVE-2015-2546	N/A	N/A	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2016-3309	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2017-0101	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2018-8120	7.0	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-0543	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-0841	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-1064	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-1069	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-1129	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-1130	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-1215	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-1253	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-1315	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-1322	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-1385	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-1388	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_exploit_cve_2019_1388.yml
Microsoft	Windows	CVE-2019-1405	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-1458	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2020-0638	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2020-0787	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2021-1675	8.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation	https://github.com/SigmaHQ/sigma/blob/master/rules/application/antivirus/av_printernightmare_cve_2021_34527.yml https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dce_rpc_printnightmare_print_driver_install.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_delete/file_delete_win_cve_2021_1675_printspooler_del.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_invoke_nightmare.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_exploit_cve_2021_1675_printspooler_security.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/printservice/win_exploit_cve_2021_1675_printspooler_operational.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/printservice/win_exploit_cve_2021_1675_printspooler.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/smbclient/win_susp_failed_guest_logon.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/file_event_win_cve_2021_1675_printspooler.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_mimikatz_printernightmare.yml
Microsoft	Windows	CVE-2021-1732	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2017-0263	7.8	HIGH	Privilege Escalation	Exploitation for Privilege Escalation
Microsoft	Windows	CVE-2019-0708	9.8	CRITICAL	Lateral Movement Initial Access	Exploit Public-Facing Application Exploitation of Remote Services	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_rdp_bluekeep_poc_scanner.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/win_rdp_potential_cve_2019_0708.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_rdp.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_termserv_proc_spawn.yml
Microsoft	Windows	CVE-2021-40444	7.8	HIGH	Execution	Exploitation for Client Execution	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/file_event_win_winword_cve_2021_40444.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_control_cve_2021_40444.yml
Microsoft	Windows Server	CVE-2020-1472	10.0	CRITICAL	Credential Access Lateral Movement	Exploitation for Credential Access Exploitation of Remote Services	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_privesc_cve_2020_1472.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/win_vul_cve_2020_1472.yml https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/win_possible_zerologon_exploitation_using_wellknown_tools.yml
Microsoft	Windows Server	CVE-2020-0609	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application
October	October CMS	CVE-2021-32648	9.1	CRITICAL	Initial Access Credential Access	Exploit Public-Facing Application Exploitation for Credential Access
Oracle	WebLogic	CVE-2020-14882	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application	https://github.com/SigmaHQ/sigma/blob/master/rules/web/web_cve_2020_14882_weblogic_exploit.yml
Oracle	WebLogic Server	CVE-2019-2725	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application
Ivanti	Pulse Secure VPN	CVE-2019-11510	10.0	CRITICAL	Initial Access	Exploit Public-Facing Application	https://github.com/SigmaHQ/sigma/blob/master/rules/web/web_pulsesecure_cve_2019_11510.yml
SonicWall	SonicOS	CVE-2020-5135	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application
VMware	Workspace One Access	CVE-2020-4006	9.1	CRITICAL	Initial Access	Exploit Public-Facing Application
VMware	Access Connector	CVE-2020-4006	9.1	CRITICAL	Initial Access	Exploit Public-Facing Application
VMware	Identity Manager	CVE-2020-4006	9.1	CRITICAL	Initial Access	Exploit Public-Facing Application
VMware	Identity Manager Connector	CVE-2020-4006	9.1	CRITICAL	Initial Access	Exploit Public-Facing Application
VMware	vCenter	CVE-2021-21972	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application	https://github.com/SigmaHQ/sigma/blob/master/rules/web/web_vsphere_cve_2021_21972_unauth_rce_exploit.yml
VMware	ESXi	CVE-2021-21972	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application	https://github.com/SigmaHQ/sigma/blob/master/rules/web/web_vsphere_cve_2021_21972_unauth_rce_exploit.yml
VMware	vCenter	CVE-2021-21985	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application
VMware	vCenter	CVE-2021-22005	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application	https://github.com/SigmaHQ/sigma/blob/master/rules/web/web_cve_2021_22005_vmware_file_upload.yml
RARLAB	WinRAR	CVE-2018-20250	7.8	HIGH	Execution	Exploitation for Client Execution
Synacor	Zimbra	CVE-2019-9670	9.8	CRITICAL	Initial Access	Exploit Public-Facing Application