CVE-2025-6204 — Dassault Systèmes DELMIA Apriso Code Injection

let AprsioPorts = dynamic([80, 443, 8080, 8443]);
let SuspiciousPatterns = dynamic(["eval(", "exec(", "system(", "passthru(", "shell_exec(", "Runtime.exec", "ProcessBuilder", "ScriptEngine", "Invoke-Expression", "cmd.exe", "powershell", "bash -c", "sh -c"]);
union DeviceNetworkEvents, DeviceProcessEvents, W3CIISLog
| where TimeGenerated > ago(24h)
| where (
    (Type == "W3CIISLog" and csUriStem contains "Apriso") or
    (Type == "DeviceNetworkEvents" and RemotePort in (AprsioPorts)) or
    (Type == "DeviceProcessEvents" and InitiatingProcessParentFileName has_any ("w3wp.exe", "java.exe", "tomcat"))
  )
| extend RequestPayload = coalesce(csUriQuery, AdditionalFields)
| where RequestPayload has_any (SuspiciousPatterns)
    or ProcessCommandLine has_any (SuspiciousPatterns)
| project TimeGenerated, DeviceName, AccountName, RemoteIP, RequestPayload, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessParentFileName
| summarize EventCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), UniqueIPs=dcount(RemoteIP) by DeviceName, AccountName, InitiatingProcessFileName
| where EventCount > 0

index=web OR index=iis OR index=wineventlog sourcetype IN ("iis", "ms:iis:auto", "WinEventLog:Security", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval combined_field = coalesce(cs_uri_query, CommandLine, ParentCommandLine, uri_query)
| where (uri_stem LIKE "%Apriso%" OR ParentImage LIKE "%w3wp%" OR ParentImage LIKE "%java%")
| where match(combined_field, "(?i)(eval\(|exec\(|system\(|passthru\(|shell_exec\(|Runtime\.exec|ProcessBuilder|ScriptEngine|Invoke-Expression|cmd\.exe|powershell|bash\s+-c|sh\s+-c|wget\s+http|curl\s+http)")
| eval src_ip = coalesce(c_ip, src_ip, src)
| stats count AS EventCount, earliest(_time) AS FirstSeen, latest(_time) AS LastSeen, dc(src_ip) AS UniqueSourceIPs, values(combined_field) AS Payloads by host, user, Image
| where EventCount > 0
| eval Severity="Critical", Detection="CVE-2025-6204 Code Injection Attempt"
| table _time, host, user, Image, UniqueSourceIPs, EventCount, Payloads, Severity, Detection

sequence by host.name with maxspan=5m
  [network where event.type == "connection" and
   destination.port in (80, 443, 8080, 8443) and
   process.name in ("w3wp.exe", "java.exe", "tomcat9.exe", "tomcat.exe")]
  [process where event.type == "start" and
   process.parent.name in ("w3wp.exe", "java.exe", "tomcat9.exe", "tomcat.exe") and
   process.name in ("cmd.exe", "powershell.exe", "sh", "bash", "python.exe", "python3", "wscript.exe", "cscript.exe", "mshta.exe") and
   not process.command_line : ("*HealthCheck*", "*DiagnosticCheck*")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip,
  destinationip,
  username,
  URL,
  "QID",
  CATEGORYNAME(category) AS EventCategory,
  logsourcename(logsourceid) AS LogSource
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Sysmon', 'Windows Security Event Log')
  AND (
    URL ILIKE '%Apriso%'
    OR "Process Name" ILIKE '%w3wp%'
    OR "Process Name" ILIKE '%java%'
  )
  AND (
    URL ILIKE '%eval(%'
    OR URL ILIKE '%exec(%'
    OR URL ILIKE '%system(%'
    OR URL ILIKE '%Runtime.exec%'
    OR "Process CommandLine" ILIKE '%cmd.exe%'
    OR "Process CommandLine" ILIKE '%powershell%'
    OR "Process CommandLine" ILIKE '%bash -c%'
    OR "Process CommandLine" ILIKE '%wget http%'
  )
  AND starttime > NOW() - 1 DAYS
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=iis OR _sourceCategory=sysmon OR _sourceCategory=windows/security
| where _raw matches /(?i)(Apriso|w3wp|java\.exe)/
| parse regex field=_raw "(?<payload>[^\s]{0,2048})"
| where payload matches /(?i)(eval\(|exec\(|system\(|passthru\(|shell_exec\(|Runtime\.exec|ProcessBuilder|cmd\.exe|powershell|bash\s+-c|sh\s+-c|wget\s+http|curl\s+http)/
| parse field=_raw "* * * *" as event_time, source_ip, dest_ip, user nodrop
| count by source_ip, user, _sourceHost
| where _count > 0
| sort by _count desc

rule cve_2025_6204_apriso_code_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-6204 code injection attempts against Dassault DELMIA Apriso"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-6204"

  events:
    (
      $e.metadata.event_type = "NETWORK_HTTP" or
      $e.metadata.event_type = "PROCESS_LAUNCH"
    )
    and (
      re.regex($e.target.url, `(?i)apriso`) or
      re.regex($e.principal.process.file.full_path, `(?i)(w3wp|java\.exe|tomcat)`)
    )
    and (
      re.regex($e.target.url, `(?i)(eval\(|exec\(|system\(|Runtime\.exec|ProcessBuilder)`) or
      re.regex($e.target.process.command_line, `(?i)(cmd\.exe|powershell|bash\s+-c|sh\s+-c|wget\s+http|curl\s+http)`)
    )

  condition:
    $e
}

event_simpleName IN ("ProcessRollup2", "NetworkConnectIP4", "NetworkConnectIP6")
| ParentBaseFileName IN ("w3wp.exe", "java.exe", "tomcat.exe", "tomcat9.exe")
  OR TargetFileName CONTAINS_INSENSITIVE "Apriso"
| ImageFileName IN ("cmd.exe", "powershell.exe", "sh", "bash", "python.exe", "python3", "wscript.exe", "cscript.exe", "mshta.exe")
  OR CommandLine CONTAINS_INSENSITIVE "eval("
  OR CommandLine CONTAINS_INSENSITIVE "exec("
  OR CommandLine CONTAINS_INSENSITIVE "system("
  OR CommandLine CONTAINS_INSENSITIVE "wget http"
  OR CommandLine CONTAINS_INSENSITIVE "curl http"
| stats count() as EventCount, min(timestamp) as FirstSeen, max(timestamp) as LastSeen, values(CommandLine) as Commands by aid, ComputerName, UserName, ParentBaseFileName, ImageFileName
| where EventCount > 0
| sort -EventCount