A Different Payload for CVE-2022-47966 - Blog - VulnCheck
Tags
Common Information
| Type | Value |
|---|---|
| UUID | cf4f4e55-5aa4-4422-9e13-01275c78be5a |
| Fingerprint | b607899b18a2b2c9 |
| Analysis status | DONE |
| Considered CTI value | 0 |
| Text language | |
| Published | Feb. 14, 2023, midnight |
| Added to db | Nov. 19, 2023, 6:16 a.m. |
| Last updated | Nov. 17, 2024, 6:55 p.m. |
| Headline | A Different Payload for CVE-2022-47966 |
| Title | A Different Payload for CVE-2022-47966 - Blog - VulnCheck |
| Detected Hints/Tags/Attributes | 50/1/50 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://vulncheck.com/blog/cve-2022-47966-payload |
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 261 | ✔ | VulnCheck Blog | https://vulncheck.com/feed/blog/atom.xml | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | CVE | 76 | cve-2022-47966 |
|
| Details | Domain | 136 | horizon3.ai |
|
| Details | Domain | 150 | www.w3.org |
|
| Details | Domain | 4 | xml.apache.org |
|
| Details | Domain | 138 | java.io |
|
| Details | Domain | 60 | java.net |
|
| Details | Domain | 454 | www.google.com |
|
| Details | File | 155 | horizon3.ai |
|
| Details | File | 26 | lang.obj |
|
| Details | File | 2125 | cmd.exe |
|
| Details | File | 1208 | powershell.exe |
|
| Details | File | 87 | java.exe |
|
| Details | File | 16 | sh.exe |
|
| Details | File | 17 | bash.exe |
|
| Details | File | 35 | pwsh.exe |
|
| Details | File | 249 | schtasks.exe |
|
| Details | File | 226 | certutil.exe |
|
| Details | File | 62 | whoami.exe |
|
| Details | File | 63 | bitsadmin.exe |
|
| Details | File | 376 | wscript.exe |
|
| Details | File | 155 | cscript.exe |
|
| Details | File | 23 | scrcons.exe |
|
| Details | File | 240 | wmic.exe |
|
| Details | File | 456 | mshta.exe |
|
| Details | File | 33 | forfiles.exe |
|
| Details | File | 12 | mftrace.exe |
|
| Details | File | 13 | appvlp.exe |
|
| Details | File | 93 | curl.exe |
|
| Details | File | 380 | notepad.exe |
|
| Details | File | 61 | systeminfo.exe |
|
| Details | File | 256 | net.exe |
|
| Details | File | 48 | net1.exe |
|
| Details | File | 165 | reg.exe |
|
| Details | File | 10 | query.exe |
|
| Details | File | 16 | lang.sys |
|
| Details | File | 2 | vulncheck.txt |
|
| Details | File | 34 | net.url |
|
| Details | File | 2 | serverout1.txt |
|
| Details | IPv4 | 4 | 111.68.7.122 |
|
| Details | IPv4 | 3 | 149.28.193.216 |
|
| Details | IPv4 | 2 | 172.93.193.64 |
|
| Details | Url | 6 | http://www.w3.org/2001/10/xml-exc-c14n# |
|
| Details | Url | 4 | http://www.w3.org/tr/1999/rec-xslt-19991116 |
|
| Details | Url | 3 | http://xml.apache.org/xalan/java/java.lang.object |
|
| Details | Url | 3 | http://xml.apache.org/xalan/java/java.lang.runtime |
|
| Details | Url | 11 | http://www.w3.org/1999/xsl/transform |
|
| Details | Url | 2 | http://xml.apache.org/xalan/java/javax.script.scriptenginemanager |
|
| Details | Url | 2 | http://xml.apache.org/xalan/java/javax.script.scriptengine |
|
| Details | Url | 2 | https://www.rapid7.com/blog/post/2023/01/19/etr-cve-2022-47966-rapid7-observed-exploitation-of-critical-manageengine-vulnerability |
|
| Details | Yara rule | 2 | rule LOG_EXPL_ManageEngine_CVE_2022_47966_Jan23 {
meta:
description = "Detects Exploitation of Critical ManageEngine Vulnerability: CVE-2022-47966"
author = "Matt Green - @mgreen27"
reference = "https://www.rapid7.com/blog/post/2023/01/19/etr-cve-2022-47966-rapid7-observed-exploitation-of-critical-manageengine-vulnerability/"
date = "2023-01-20"
strings:
$s1 = "com.adventnet.authentication.saml.SamlException: Signature validation failed. SAML Response rejected"
$re1 = /invalid_response --> .{20,}/s
$ip1 = "111.68.7.122"
$ip2 = "149.28.193.216"
$ip3 = "172.93.193.64"
condition:
any of them
} |