Detect VMware vCenter Server Out-of-bounds Write (CVE-2024-37079) in Elastic Security
Detects exploitation attempts targeting CVE-2024-37079, an out-of-bounds write vulnerability (CWE-787) in Broadcom VMware vCenter Server. This KEV-listed vulnerability allows unauthenticated remote attackers to trigger memory corruption via malformed DCERPC requests to the vCenter management interface, potentially leading to remote code execution with SYSTEM-level privileges on the vCenter appliance.
MITRE ATT&CK
Elastic Detection Query
sequence by host.name with maxspan=5m
[process where event.type == "start" and
process.name in ("vpxd", "vmdir", "vmdird", "vmafdd", "vmcad") and
host.os.type == "linux"]
[process where event.type == "end" and
process.name in ("vpxd", "vmdir", "vmdird", "vmafdd") and
process.exit_code != 0]
OR
any where
(
(event.dataset == "system.syslog" and
host.name : ("*vcenter*", "*vcs*") and
message : ("segfault", "heap-buffer-overflow", "SIGSEGV", "SIGABRT", "core dumped", "stack smashing"))
OR
(event.category == "network" and
destination.port in (443, 902, 5480, 9443) and
destination.ip : ("*vcenter*") and
network.protocol == "tcp" and
event.action == "connection_attempted")
)Elastic EQL sequence detection correlating abnormal vCenter process terminations with memory corruption signals and anomalous inbound connections to vCenter management ports as indicators of CVE-2024-37079 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Planned vCenter maintenance or upgrades causing daemon restarts with non-zero exit codes
- Resource exhaustion (OOM) events killing vCenter processes mimicking crash signatures
- Automated integration tests in non-production vCenter environments
- VMware Tools updates causing transient process churn across managed hosts
Other platforms for CVE-2024-37079
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate vCenter DCERPC Malformed Request (Lab Only)
Expected signal: Network flow log entry showing TCP connection attempt to target:135 with large payload; vCenter DCERPC service log entry showing parse error or malformed packet rejection
- Test 2Trigger vCenter vpxd Process Crash via Resource Exhaustion (Lab Only)
Expected signal: Syslog entry on vCenter appliance: vpxd[PID]: segfault at [address]; core dump file created at /var/core/vpxd-[timestamp].core
- Test 3Probe vCenter Management Ports from Unauthorized IP (Lab Only)
Expected signal: Firewall/network logs showing TCP SYN packets from scanner IP to vCenter management ports; vCenter access logs showing connection attempts to /ui, /sdk, VAMI endpoints
- Test 4Validate vCenter Log Forwarding and Crash Pattern Matching
Expected signal: Syslog message appearing in SIEM ingestion pipeline with process name vpxd and severity daemon.crit containing the synthetic crash string
Unlock Pro Content
Get the full detection package for CVE-2024-37079 including response playbook, investigation guide, and atomic red team tests.