Detect Quest KACE SMA Improper Authentication Exploitation Detected in IBM QRadar
Detects exploitation attempts against CVE-2025-32975, an improper authentication vulnerability (CWE-287) in Quest KACE Systems Management Appliance (SMA). This KEV-listed vulnerability allows attackers to bypass authentication controls, potentially enabling unauthorized access to the SMA management interface and downstream managed endpoints. Successful exploitation could lead to full appliance compromise and lateral movement across managed systems.
MITRE ATT&CK
QRadar Detection Query
SELECT sourceip, destinationip, destinationport, URL, username, eventcount, MIN(starttime) AS first_seen, MAX(starttime) AS last_seen,
SUM(CASE WHEN URL LIKE '%/admin%' OR URL LIKE '%/userui%' OR URL LIKE '%/api/users%' THEN 1 ELSE 0 END) AS admin_requests,
SUM(CASE WHEN responseCode IN (200, 302, 301) AND (URL LIKE '%/admin%' OR URL LIKE '%/userui%') THEN 1 ELSE 0 END) AS successful_admin_access
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'Nginx', 'F5 BIG-IP')
AND destinationport IN (80, 443, 8080, 8443)
AND (URL LIKE '%/admin%' OR URL LIKE '%/userui%' OR URL LIKE '%/api%' OR URL LIKE '%/service%')
AND LAST 24 HOURS
GROUP BY sourceip, destinationip, destinationport, URL, username
HAVING admin_requests > 10 OR successful_admin_access > 3
ORDER BY admin_requests DESCQueries QRadar for suspicious access patterns to Quest KACE SMA administrative endpoints, identifying sources with high volumes of admin endpoint requests or multiple successful accesses to privileged paths that may indicate authentication bypass exploitation.
Data Sources
Required Tables
False Positives & Tuning
- IT operations staff performing routine KACE appliance administration
- Automated patch deployment processes accessing KACE API endpoints
- Network monitoring tools performing connectivity checks to KACE management ports
- Web application firewall testing generating traffic to KACE endpoints
Other platforms for CVE-2025-32975
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1KACE SMA Unauthenticated Admin Endpoint Enumeration
Expected signal: Web server access logs showing GET requests to /admin, /userui, /api/users, /service/ambari without authentication cookies; network flow records showing HTTP connections to KACE SMA on port 443
- Test 2KACE SMA Authentication Bypass Simulation via Missing Auth Header
Expected signal: Web server logs showing requests to /admin/, /admin/index.php, /api/users with empty or missing authentication cookies; HTTP response codes indicating whether bypass was successful (200/302) or properly rejected (401/403)
- Test 3Post-Exploitation KACE Agent Script Deployment Simulation
Expected signal: KACE SMA audit log entry showing script creation by the test account; network logs showing authentication followed by POST request to /api/script; SIEM alert on new script creation event from an account that recently logged in from an unusual IP
Response Playbook
Triage
- Identify the source IP(s) generating suspicious requests to KACE SMA endpoints and determine if they are internal trusted hosts, external IPs, or known threat infrastructure using threat intelligence lookups.
- Review the specific HTTP endpoints accessed (e.g., /admin, /userui, /api/users) and correlate response codes — 200/302 responses to admin paths without valid session tokens indicate active exploitation.
- Check Quest KACE SMA authentication logs (typically in /var/log/kace/ or accessible via SMA admin console under Reporting > Audit Log) for failed authentication attempts followed by successful access from the same source IP.
- Determine the KACE SMA version and patch level via the admin console (Settings > About) and cross-reference with Quest advisory to assess if the instance is a vulnerable version.
- Enumerate what actions were taken post-authentication: check KACE audit logs for agent deployments, script executions, policy changes, or new user creation that would indicate attacker persistence.
Containment
- Immediately block the offending source IP(s) at the network perimeter firewall and web application firewall, and isolate the KACE SMA appliance from external network access if external-facing exploitation is confirmed.
- Disable or revoke all active KACE SMA administrative sessions via Settings > Users in the admin console, force re-authentication for all users, and rotate all KACE service account credentials and API tokens.
- Apply Quest's recommended patches or mitigations from KB4379499 immediately; if patching cannot be performed immediately, restrict network access to the KACE SMA management interface to known administrator IP ranges only.
Evidence Collection
- Export and preserve KACE SMA audit logs from the admin console (Reporting > Audit Log) covering the period of suspected exploitation, ensuring logs capture user activity, policy changes, and agent deployments.
- Capture network traffic logs (firewall, proxy, or packet capture) showing all connections to the KACE SMA during the incident window, preserving source IPs, timestamps, HTTP methods, endpoints, and response codes.
- Collect KACE agent deployment history from managed endpoints to identify any unauthorized software pushes, script executions, or configuration changes that may have been deployed via the compromised appliance.
Escalation Criteria
- !Escalate to incident response if unauthorized admin accounts have been created in KACE SMA, or if the appliance has been used to deploy unauthorized agents, scripts, or software to managed endpoints — indicating lateral movement.
- !Escalate immediately if the KACE SMA manages endpoints in sensitive network segments (OT/ICS, PCI, healthcare) or if evidence shows the attacker accessed KACE's stored credentials, managed device inventories, or patch deployment capabilities.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
KACE SMA web server access logs showing HTTP requests to /admin, /userui, and API endpoints with anomalous authentication patterns - >
KACE audit log entries (Reporting > Audit Log in admin console) showing unexpected user creations, policy modifications, or agent package deployments - >
Network flow records showing the KACE SMA initiating unexpected outbound connections to attacker-controlled infrastructure after compromise - >
KACE managed endpoint logs showing unexpected software deployments, script executions, or configuration changes pushed from the compromised SMA
Tuning Guidance
This detection generates medium confidence alerts due to the difficulty of distinguishing legitimate admin activity from authentication bypass without KACE-specific session token validation. To reduce false positives: (1) Whitelist known KACE administrator source IPs using a reference watchlist and exclude them from alerting, (2) Integrate KACE SMA audit logs directly into your SIEM to correlate HTTP requests with authenticated sessions — unauthenticated requests to /admin paths become high-confidence detections, (3) Tune the request_count thresholds based on your organization's KACE usage patterns (heavily used appliances may need thresholds of 50+ requests), (4) Focus highest-priority alerting on new source IPs that have never previously accessed the KACE interface, especially if they originate outside your corporate IP space, (5) Correlate with Quest KB4379499 to determine if your specific KACE SMA version is in the affected range and adjust confidence accordingly.
Hunting Queries
Hunt for KACE SMA authentication bypass exploitation over the past 7 days by identifying requests to privileged endpoints with missing or minimal session cookies that may indicate pre-authentication access attempts.
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DestinationPort in (80, 443, 8080, 8443)
| where RequestURL has_any ("/admin", "/userui", "/api/users", "/service")
| where isempty(AdditionalExtensions) or AdditionalExtensions !has "session"
| summarize count() by SourceIP, DestinationIP, RequestURL, bin(TimeGenerated, 1h)
| where count_ > 5
| order by count_ descindex=web earliest=-7d
| where (uri_path="/admin*" OR uri_path="/userui*" OR uri_path="/api*")
| where isnull(cookie) OR len(cookie)<20
| stats count AS hits, values(uri_path) AS paths BY src_ip, dest_ip, dest_port, date_hour
| where hits > 5
| sort - hitsHunt for KACE agent processes on managed endpoints initiating unexpected outbound connections to external IPs, which may indicate the KACE SMA was used to deploy malware or C2 implants after authentication bypass.
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where RemotePort in (80, 443, 8080, 8443)
| where InitiatingProcessName in~ ("kace", "kbot", "kagent")
| where ActionType == "ConnectionSuccess"
| where RemoteIPType != "Private"
| summarize ConnectionCount = count(), RemoteIPs = make_set(RemoteIP, 50) by DeviceName, InitiatingProcessName, RemotePort, bin(TimeGenerated, 1h)
| where ConnectionCount > 10 or array_length(RemoteIPs) > 3index=endpoint sourcetype=crowdstrike:events OR sourcetype=sysmon
| where (process_name="kace*" OR process_name="kbot*" OR process_name="kagent*")
| where dest_ip NOT IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
| stats count AS outbound_connections, values(dest_ip) AS external_ips BY host, process_name, dest_port
| where outbound_connections > 5 OR mvcount(external_ips) > 2Atomic Red Team Tests
Simulates reconnaissance phase of CVE-2025-32975 exploitation by probing KACE SMA administrative endpoints without authentication to identify bypass opportunities. Lab environment only — requires isolated KACE SMA instance.
Command
#!/bin/bash
KACE_HOST="192.168.100.50" # Lab KACE SMA IP
KACE_PORT="443"
ENDPOINTS=("/admin" "/userui" "/api/users" "/service/ambari" "/admin/index.php" "/userui/login.php")
echo "[*] Starting unauthenticated KACE SMA endpoint enumeration"
for endpoint in "${ENDPOINTS[@]}"; do
response=$(curl -sk -o /dev/null -w "%{http_code}" -m 10 \
-H "User-Agent: Mozilla/5.0 (compatible; SecurityTest/1.0)" \
"https://${KACE_HOST}:${KACE_PORT}${endpoint}")
echo "[*] ${endpoint} -> HTTP ${response}"
sleep 1
done
echo "[*] Enumeration complete"Cleanup
No cleanup required — read-only HTTP requests generate no persistent changes on targetExpected Telemetry
Web server access logs showing GET requests to /admin, /userui, /api/users, /service/ambari without authentication cookies; network flow records showing HTTP connections to KACE SMA on port 443
Expected Detection
SIEM alert triggered by multi-endpoint probing pattern from single source IP; WAF logs showing unauthenticated requests to administrative paths
Tests detection capability for requests to KACE SMA admin endpoints that omit authentication headers, simulating the improper authentication bypass pattern of CVE-2025-32975. Requires lab KACE instance.
Command
#!/bin/bash
KACE_HOST="192.168.100.50" # Lab KACE SMA IP
KACE_PORT="443"
echo "[*] Testing authentication bypass patterns"
# Test 1: Direct admin access without session cookie
echo "[+] Test 1: No authentication headers"
curl -sk -v -m 15 \
-H "User-Agent: Mozilla/5.0" \
-H "Accept: text/html,application/xhtml+xml" \
"https://${KACE_HOST}:${KACE_PORT}/admin/" 2>&1 | grep -E "HTTP|Location|Set-Cookie"
# Test 2: Malformed session token
echo "[+] Test 2: Malformed/empty session token"
curl -sk -v -m 15 \
-H "Cookie: KACE_COOKIE=" \
-H "X-Forwarded-For: 127.0.0.1" \
"https://${KACE_HOST}:${KACE_PORT}/admin/index.php" 2>&1 | grep -E "HTTP|Location|Set-Cookie"
# Test 3: API endpoint without bearer token
echo "[+] Test 3: API access without bearer token"
curl -sk -m 15 \
-H "Content-Type: application/json" \
"https://${KACE_HOST}:${KACE_PORT}/api/users" 2>&1 | python3 -m json.tool 2>/dev/null || echo "Non-JSON response"Cleanup
No persistent changes; all requests are stateless HTTP probesExpected Telemetry
Web server logs showing requests to /admin/, /admin/index.php, /api/users with empty or missing authentication cookies; HTTP response codes indicating whether bypass was successful (200/302) or properly rejected (401/403)
Expected Detection
Detection rule triggering on requests to admin endpoints with missing/empty authentication cookies followed by non-401/403 responses; alerts on X-Forwarded-For header manipulation attempts
Simulates post-exploitation activity after successful KACE SMA authentication bypass — specifically the deployment of a script to managed endpoints via KACE's machine action feature. Requires compromised or test KACE admin credentials in a lab environment.
Command
#!/bin/bash
KACE_HOST="192.168.100.50" # Lab KACE SMA IP
KACE_USER="lab_admin"
KACE_PASS="LabPassword123!"
SCRIPT_NAME="security_test_$(date +%s)"
echo "[*] Simulating post-exploitation KACE script deployment"
# Step 1: Authenticate to KACE SMA
echo "[+] Step 1: Authenticating to KACE SMA"
COOKIE_JAR=$(mktemp)
curl -sk -c "${COOKIE_JAR}" -m 15 \
-d "login_name=${KACE_USER}&login_passwd=${KACE_PASS}" \
"https://${KACE_HOST}/admin/login" -o /dev/null
# Step 2: Create a test script (echo command - harmless)
echo "[+] Step 2: Attempting to create test script via API"
curl -sk -b "${COOKIE_JAR}" -m 15 \
-X POST \
-H "Content-Type: application/json" \
-d "{\"name\":\"${SCRIPT_NAME}\",\"script_type\":\"KScript\",\"enabled\":false,\"script_contents\":\"# Lab security test only\\necho 'kace_test_telemetry'\"}" \
"https://${KACE_HOST}/api/script" | python3 -m json.tool 2>/dev/null
rm -f "${COOKIE_JAR}"
echo "[*] Test complete — review KACE audit logs for script creation event"Cleanup
Log into KACE SMA admin console, navigate to Scripting > Scripts, locate the script named 'security_test_*', and delete it. Verify deletion in Reporting > Audit Log.Expected Telemetry
KACE SMA audit log entry showing script creation by the test account; network logs showing authentication followed by POST request to /api/script; SIEM alert on new script creation event from an account that recently logged in from an unusual IP
Expected Detection
Detection rule correlating KACE authentication event followed immediately by privileged action (script creation); UEBA alert on unusual administrative activity pattern; SIEM correlation rule matching initial access followed by software deployment tool usage (T1072)