Detect VMware vCenter Server Out-of-bounds Write (CVE-2024-37079) in CrowdStrike LogScale
Detects exploitation attempts targeting CVE-2024-37079, an out-of-bounds write vulnerability (CWE-787) in Broadcom VMware vCenter Server. This KEV-listed vulnerability allows unauthenticated remote attackers to trigger memory corruption via malformed DCERPC requests to the vCenter management interface, potentially leading to remote code execution with SYSTEM-level privileges on the vCenter appliance.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName IN (ProcessRollup2, SyntheticProcessRollup2, NetworkConnectIP4, NetworkConnectIP6, CriticalEnvironmentBreachDetectionEvent)
| $falcon.ProcessImageFileName = /vpxd|vmdir|vmdird|vmafdd|vmcad/
OR ($falcon.RemotePort IN (443, 902, 5480, 9443) AND $falcon.LocalAddressIP4 = /vcenter/)
OR ($falcon.event_simpleName = "CriticalEnvironmentBreachDetectionEvent")
| eval vcenter_process = if(match($falcon.ProcessImageFileName, /vpxd|vmdir|vmdird|vmafdd/), "true", "false")
| eval mgmt_port_hit = if($falcon.RemotePort IN (443, 902, 5480, 9443), "true", "false")
| eval indicator_type = case(
vcenter_process = "true" AND $falcon.event_simpleName = "CriticalEnvironmentBreachDetectionEvent", "crash_exploit",
mgmt_port_hit = "true", "management_port_probe",
true(), "generic"
)
| stats count() AS event_count, dc($falcon.aip) AS unique_ips, values($falcon.ComputerName) AS hosts, values($falcon.ProcessImageFileName) AS processes, values($falcon.RemotePort) AS ports, earliest($falcon.timestamp) AS first_seen, latest($falcon.timestamp) AS last_seen BY indicator_type, $falcon.aid
| where event_count > 0
| sort last_seen descCrowdStrike Falcon CQL query correlating vCenter daemon process crash events, critical environment breach detections, and management port connection events to identify CVE-2024-37079 exploitation activity on protected vCenter hosts.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike sensor updates or policy changes triggering process re-scans on vCenter hosts
- VMware vSphere Lifecycle Manager initiating planned vCenter process restarts flagged as crashes
- Authorized red team operations against vCenter within approved engagement windows
- Backup software establishing connections to vCenter management ports from unregistered IPs
Other platforms for CVE-2024-37079
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate vCenter DCERPC Malformed Request (Lab Only)
Expected signal: Network flow log entry showing TCP connection attempt to target:135 with large payload; vCenter DCERPC service log entry showing parse error or malformed packet rejection
- Test 2Trigger vCenter vpxd Process Crash via Resource Exhaustion (Lab Only)
Expected signal: Syslog entry on vCenter appliance: vpxd[PID]: segfault at [address]; core dump file created at /var/core/vpxd-[timestamp].core
- Test 3Probe vCenter Management Ports from Unauthorized IP (Lab Only)
Expected signal: Firewall/network logs showing TCP SYN packets from scanner IP to vCenter management ports; vCenter access logs showing connection attempts to /ui, /sdk, VAMI endpoints
- Test 4Validate vCenter Log Forwarding and Crash Pattern Matching
Expected signal: Syslog message appearing in SIEM ingestion pipeline with process name vpxd and severity daemon.crit containing the synthetic crash string
Unlock Pro Content
Get the full detection package for CVE-2024-37079 including response playbook, investigation guide, and atomic red team tests.