Detects payload as seen in PoC code to exploit Workspace ONE Access freemarker server-side template injection CVE-2022-2

Hunt Hypothesis

This hunt hypothesis identifies adversary exploitation of the Workspace ONE Access Freemarker Server-Side Template Injection vulnerability (CVE-2022-22954) by detecting specific payload patterns observed in proof-of-concept attack code. Proactive hunting for this behavior within Azure Sentinel is critical to prevent potential remote code execution and unauthorized access, given the high severity of the underlying vulnerability in identity management systems.

YARA Rule

rule LOG_SUSP_EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22_ {
   meta:
      old_rule_name = "EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22"
      description = "Detects payload as seen in PoC code to exploit Workspace ONE Access freemarker server-side template injection CVE-2022-22954"
      author = "Florian Roth"
      reference = "https://github.com/sherlocksecurity/VMware-CVE-2022-22954"
      reference2 = "https://twitter.com/rwincey/status/1512241638994853891/photo/1"
      date = "2022-04-08"
      modified = "2025-03-29"
      score = 60
      id = "b46e5cf2-ab5b-5574-a67b-e774063ccd6d"
   strings:
      $x1 = "66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28" ascii

      $fp2 = "ModSecurity"
      $fp3 = " 302 -"
   condition:
      1 of ($x*)
      and not 1 of ($fp*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Workspace ONE Access FreeMarker Server-Side Template Injection (CVE-2022-22954) detection rule, along with suggested filters:

Scenario: Scheduled Health Check Automation
- Context: The enterprise utilizes a custom Python-based monitoring script (e.g., running via cron or Windows Task Scheduler) that periodically sends HTTP GET requests to the Workspace ONE Access API endpoint /api/v1/health. This script includes a standard JSON header containing template literals like ${timestamp} and ${hostname} which mimic the FreeMarker syntax used in the exploit payload.
- Suggested Filter: Create an exclusion rule based on the Source IP Address of the dedicated monitoring server (e.g., 10.20.5.45) or filter traffic where the HTTP User-Agent matches the specific monitoring tool signature (e.g., HealthCheck-Script/1.0).
Scenario: Legacy Integration Webhook Payloads
- Context: A third-party Identity Provider (IdP) such as Okta or Azure AD sends webhook notifications to Workspace ONE Access for user provisioning events. The payload body often contains XML or JSON structures with embedded FreeMarker-like tags (e.g., <#if user.active>) used by the IdP’s internal templating engine, which triggers the detection logic despite not being an injection attack vector.
- Suggested Filter: Exclude traffic originating from known IdP IP ranges or filter based on the HTTP Method if the rule is sensitive to POST requests containing specific XML namespaces that are part of standard SAML/OIDC flows but resemble the exploit pattern.
Scenario: Admin-Driven Template Configuration Updates
- Context: During business hours, Workspace ONE administrators perform routine maintenance by updating custom email notification templates