VMware vCenter Server Out-of-bounds Write (CVE-2024-37079)

let vcenter_ips = dynamic([]);
union
(
    CommonSecurityLog
    | where DeviceProduct has_any ("vCenter", "VMware vCenter")
    | where Message has_any ("out-of-bounds", "heap corruption", "DCERPC", "vmdir", "vpxd crash", "core dump", "segfault")
    | project TimeGenerated, DeviceAddress, SourceIP, DestinationIP, Message, Activity, DeviceProduct
),
(
    Syslog
    | where ProcessName in ("vpxd", "vmdir", "vmdird", "vmafdd")
    | where SyslogMessage has_any ("segfault", "core dumped", "heap-buffer-overflow", "stack smashing", "SIGABRT", "SIGSEGV")
    | project TimeGenerated, HostName, HostIP, ProcessName, SyslogMessage
),
(
    AzureActivity
    | where ResourceProviderValue =~ "Microsoft.AVS"
    | where OperationNameValue has_any ("write", "update") and ActivityStatusValue =~ "Failed"
    | project TimeGenerated, CallerIpAddress, ResourceGroup, OperationNameValue, ActivityStatusValue
),
(
    CommonSecurityLog
    | where DestinationPort in (443, 902, 5480, 9443)
    | where DeviceVendor has_any ("VMware", "Broadcom")
    | where Activity has_any ("exploit", "attack", "CVE-2024-37079")
    | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, Activity, Message
)
| sort by TimeGenerated desc

index=* sourcetype IN ("vmware:vcenter:log", "vmware:esxi:syslog", "linux_secure", "syslog", "cisco:asa", "pan:traffic")
(host=*vcenter* OR host=*vcs* OR host=*vc[0-9]*)
(
  (
    (source="/var/log/vmware/vpxd/vpxd.log" OR source="/var/log/vmware/vmdird/vmdird.log")
    ("segfault" OR "core dump" OR "heap-buffer-overflow" OR "SIGABRT" OR "SIGSEGV" OR "out of bounds" OR "stack smashing detected")
  )
  OR
  (
    sourcetype IN ("cisco:asa", "pan:traffic", "juniper:junos:firewall")
    dest_port IN (443, 902, 5480, 9443)
    ("CVE-2024-37079" OR "exploit" OR "scanner")
  )
  OR
  (
    sourcetype="vmware:vcenter:log"
    ("DCERPC" OR "RPC fault" OR "malformed request" OR "unexpected token" OR "parse error")
  )
)
| eval severity=case(
    match(_raw, "segfault|SIGSEGV|heap-buffer-overflow|core dump"), "critical",
    match(_raw, "DCERPC|RPC fault|malformed request"), "high",
    true(), "medium"
  )
| stats count AS event_count, values(severity) AS severities, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(src_ip) AS source_ips BY host, source, sourcetype
| where event_count > 0
| sort - last_seen

sequence by host.name with maxspan=5m
  [process where event.type == "start" and
   process.name in ("vpxd", "vmdir", "vmdird", "vmafdd", "vmcad") and
   host.os.type == "linux"]
  [process where event.type == "end" and
   process.name in ("vpxd", "vmdir", "vmdird", "vmafdd") and
   process.exit_code != 0]

OR

any where
  (
    (event.dataset == "system.syslog" and
     host.name : ("*vcenter*", "*vcs*") and
     message : ("segfault", "heap-buffer-overflow", "SIGSEGV", "SIGABRT", "core dumped", "stack smashing"))
    OR
    (event.category == "network" and
     destination.port in (443, 902, 5480, 9443) and
     destination.ip : ("*vcenter*") and
     network.protocol == "tcp" and
     event.action == "connection_attempted")
  )

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  logsourcename(logsourceid) AS log_source,
  category,
  QIDNAME(qid) AS event_name,
  "username",
  magnitude,
  UTF8(payload) AS raw_payload
FROM events
WHERE
  (
    (
      logsourcetypename(devicetype) ILIKE '%VMware%'
      AND (
        UTF8(payload) ILIKE '%segfault%'
        OR UTF8(payload) ILIKE '%heap-buffer-overflow%'
        OR UTF8(payload) ILIKE '%SIGSEGV%'
        OR UTF8(payload) ILIKE '%core dump%'
        OR UTF8(payload) ILIKE '%out of bounds%'
        OR UTF8(payload) ILIKE '%DCERPC%'
        OR UTF8(payload) ILIKE '%vpxd%crash%'
        OR UTF8(payload) ILIKE '%CVE-2024-37079%'
      )
    )
    OR
    (
      destinationport IN (443, 902, 5480, 9443)
      AND destinationip INCIDR '0.0.0.0/0'
      AND category = 'Application'
      AND magnitude >= 6
    )
  )
  AND LOGSOURCETIME(starttime) > NOW() - 1 HOURS
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=*vmware* OR _sourceCategory=*vcenter*
| parse "*" as raw_message
| where raw_message matches /segfault|heap-buffer-overflow|SIGSEGV|SIGABRT|core dump(ed)?|stack smashing|out.of.bounds|DCERPC|RPC fault|malformed request|CVE-2024-37079/ OR
  (_sourceCategory matches /firewall|network|palo_alto|cisco_asa/ and (raw_message matches /:(443|902|5480|9443)/ and raw_message matches /vcenter|vcs/))
| extract "(?P<process>vpxd|vmdir|vmdird|vmafdd|vmcad)" from raw_message nodrop
| extract "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" from raw_message nodrop
| eval crash_indicator = if(raw_message matches /segfault|SIGSEGV|core dump|heap-buffer-overflow/, "true", "false")
| eval rpc_indicator = if(raw_message matches /DCERPC|RPC fault|malformed request/, "true", "false")
| timeslice 5m
| stats count as event_count, count_distinct(src_ip) as unique_sources, values(process) as affected_processes, sum(if(crash_indicator="true",1,0)) as crash_events, sum(if(rpc_indicator="true",1,0)) as rpc_events by _timeslice, _sourceHost
| where event_count > 0
| sort by _timeslice desc

rule cve_2024_37079_vcenter_oob_write {
  meta:
    author = "df00tech"
    description = "Detects CVE-2024-37079 exploitation: VMware vCenter Server out-of-bounds write via memory corruption signals and anomalous management port activity"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453"
    cve = "CVE-2024-37079"
    mitre_attack = "T1190"

  events:
    (
      (
        $e1.metadata.event_type = "PROCESS_UNCAUGHT_EXCEPTION"
        and $e1.principal.hostname = /vcenter|vcs/
        and $e1.target.process.file.full_path = /vpxd|vmdir|vmdird|vmafdd/
      )
      or
      (
        $e1.metadata.event_type = "NETWORK_CONNECTION"
        and (
          $e1.target.port = 443
          or $e1.target.port = 902
          or $e1.target.port = 5480
          or $e1.target.port = 9443
        )
        and $e1.target.hostname = /vcenter|vcs/
        and not $e1.principal.ip in %authorized_management_cidrs
      )
      or
      (
        $e1.metadata.event_type = "GENERIC_EVENT"
        and $e1.principal.hostname = /vcenter|vcs/
        and $e1.metadata.description = /segfault|heap-buffer-overflow|SIGSEGV|core dump|DCERPC|out.of.bounds|CVE-2024-37079/
      )
    )

  condition:
    $e1
}

#event_simpleName IN (ProcessRollup2, SyntheticProcessRollup2, NetworkConnectIP4, NetworkConnectIP6, CriticalEnvironmentBreachDetectionEvent)
| $falcon.ProcessImageFileName = /vpxd|vmdir|vmdird|vmafdd|vmcad/
  OR ($falcon.RemotePort IN (443, 902, 5480, 9443) AND $falcon.LocalAddressIP4 = /vcenter/)
  OR ($falcon.event_simpleName = "CriticalEnvironmentBreachDetectionEvent")
| eval vcenter_process = if(match($falcon.ProcessImageFileName, /vpxd|vmdir|vmdird|vmafdd/), "true", "false")
| eval mgmt_port_hit = if($falcon.RemotePort IN (443, 902, 5480, 9443), "true", "false")
| eval indicator_type = case(
    vcenter_process = "true" AND $falcon.event_simpleName = "CriticalEnvironmentBreachDetectionEvent", "crash_exploit",
    mgmt_port_hit = "true", "management_port_probe",
    true(), "generic"
  )
| stats count() AS event_count, dc($falcon.aip) AS unique_ips, values($falcon.ComputerName) AS hosts, values($falcon.ProcessImageFileName) AS processes, values($falcon.RemotePort) AS ports, earliest($falcon.timestamp) AS first_seen, latest($falcon.timestamp) AS last_seen BY indicator_type, $falcon.aid
| where event_count > 0
| sort last_seen desc