CVE2022

CVE-2022-22954

1Rules

2References

1Folders

2022-04-25Latest

Summary

CVE-2022-22954 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2022. Coverage centers on windows / process_creation.

Related Detections

Search this threat

Emerging Threatmediumtest

Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution

Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.

WindowsProcess Creation

TA0002 · ExecutionTA0001 · Initial AccessT1059.006 · PythonT1190 · Exploit Public-Facing Application+2

kostastsaleMon Apr 252022

References