Detect VMware vCenter Server Out-of-bounds Write (CVE-2024-37079) in Google Chronicle

rule cve_2024_37079_vcenter_oob_write {
  meta:
    author = "df00tech"
    description = "Detects CVE-2024-37079 exploitation: VMware vCenter Server out-of-bounds write via memory corruption signals and anomalous management port activity"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453"
    cve = "CVE-2024-37079"
    mitre_attack = "T1190"

  events:
    (
      (
        $e1.metadata.event_type = "PROCESS_UNCAUGHT_EXCEPTION"
        and $e1.principal.hostname = /vcenter|vcs/
        and $e1.target.process.file.full_path = /vpxd|vmdir|vmdird|vmafdd/
      )
      or
      (
        $e1.metadata.event_type = "NETWORK_CONNECTION"
        and (
          $e1.target.port = 443
          or $e1.target.port = 902
          or $e1.target.port = 5480
          or $e1.target.port = 9443
        )
        and $e1.target.hostname = /vcenter|vcs/
        and not $e1.principal.ip in %authorized_management_cidrs
      )
      or
      (
        $e1.metadata.event_type = "GENERIC_EVENT"
        and $e1.principal.hostname = /vcenter|vcs/
        and $e1.metadata.description = /segfault|heap-buffer-overflow|SIGSEGV|core dump|DCERPC|out.of.bounds|CVE-2024-37079/
      )
    )

  condition:
    $e1
}