Detects payload as seen in PoC code to exploit Workspace ONE Access freemarker server-side template injection CVE-2022-2

Hunt Hypothesis

This hunt hypothesis identifies adversary exploitation of the Workspace ONE Access Server-Side Template Injection vulnerability (CVE-2022-22954) by detecting specific payload signatures associated with proof-of-concept attack code. Proactively hunting for this behavior in Azure Sentinel is critical to identify early-stage compromise attempts that could lead to remote code execution and unauthorized access within the identity management infrastructure.

YARA Rule

rule SUSP_EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22_1 {
   meta:
      old_rule_name = "EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22"
      description = "Detects payload as seen in PoC code to exploit Workspace ONE Access freemarker server-side template injection CVE-2022-22954"
      author = "Florian Roth"
      reference = "https://github.com/sherlocksecurity/VMware-CVE-2022-22954"
      reference2 = "https://twitter.com/rwincey/status/1512241638994853891/photo/1"
      date = "2022-04-08"
      modified = "2025-03-29"
      score = 60
      id = "3ff617bb-6dcd-576f-a1c3-7be1c19c0d5a"
   strings:
      $x2 = "${\"freemarker.template.utility.Execute\"?new()("
      $x3 = "cat /etc/passwd\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
      $x4 = "cat /etc/passwd\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"
      $x5 = "cat /etc/shadow\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
      $x6 = "cat /etc/shadow\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"

      $fpg1 = "All Rights"
      $fpg2 = "<html"
      $fpg3 = "<HTML"
      $fpg4 = "Copyright" ascii wide
      $fpg5 = "License"
      $fpg6 = "<?xml"
      $fpg7 = "Help" fullword
      $fpg8 = "COPYRIGHT" ascii wide fullword
      $fpg9 = "Backup"

      $fp1 = "severity: critical" // nuclei
   condition:
      1 of ($x*)
      and not 1 of ($fp*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 15 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Workspace ONE Access Freemarker Server-Side Template Injection (CVE-2022-22954) detection rule, including suggested filters and exclusions:

Scenario: Automated Health Check Scripts by Monitoring Tools
- Context: Enterprise monitoring solutions like SolarWinds NPM, Datadog Agent, or PRTG Network Monitor frequently perform scheduled HTTP GET requests to the Workspace ONE Access endpoint (/access) to verify service availability. These tools often include custom headers or payload bodies containing template syntax (e.g., ${...}) in their health check probes, which mimics the injection payload structure of the CVE-2022-22954 proof-of-concept code.
- Suggested Filter/Exclusion: Create a whitelist exclusion based on the source IP address range of the monitoring infrastructure (e.g., 10.10.50.0/24) or filter out traffic where the User-Agent string matches known monitoring tools (e.g., User-Agent: SolarWinds-HealthCheck).
Scenario: Scheduled Backup and Reporting Jobs
- Context: Internal administrative scripts using PowerShell, Ansible, or Terraform are often scheduled to run nightly via Windows Task Scheduler or Cron. These jobs query the Workspace ONE API to generate compliance reports or backup user access logs. The scripts may dynamically construct JSON payloads containing Freemarker-like string interpolation variables (e.g., {{user_id}}), triggering the detection logic as a potential template injection attempt.
- Suggested Filter/Exclusion: Exclude traffic originating from specific service accounts used for automation (e.g., svc-backup, admin-automation) or filter requests where the HTTP method is GET and the request body size