Emerging Threathightest

Exploitation Indicator Of CVE-2022-42475

Detects exploitation indicators of CVE-2022-42475 a heap-based buffer overflow in sslvpnd.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems), Nilaa Maharjan, Douglasrose75Created Thu Feb 08293ccb8c-bed8-4868-8296-bef30e303b7e2022

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

fortiossslvpnd

Productfortios← raw: fortios

Servicesslvpnd← raw: sslvpnd

Definition

Requirements: file creation events or equivalent must be collected from the FortiOS SSL-VPN appliance in order for this detection to function correctly

Detection Logic

detection:
    keywords:
        - '/data/etc/wxd.conf'
        - '/data/lib/libgif.so'
        - '/data/lib/libips.bak'
        - '/data/lib/libiptcp.so'
        - '/data/lib/libipudp.so'
        - '/data/lib/libjepg.so'
        - '/var/.sslvpnconfigbk'
    condition: keywords