Detect VMware vCenter Server Out-of-bounds Write (CVE-2024-37079) in IBM QRadar
Detects exploitation attempts targeting CVE-2024-37079, an out-of-bounds write vulnerability (CWE-787) in Broadcom VMware vCenter Server. This KEV-listed vulnerability allows unauthenticated remote attackers to trigger memory corruption via malformed DCERPC requests to the vCenter management interface, potentially leading to remote code execution with SYSTEM-level privileges on the vCenter appliance.
MITRE ATT&CK
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
sourceip,
destinationip,
destinationport,
logsourcename(logsourceid) AS log_source,
category,
QIDNAME(qid) AS event_name,
"username",
magnitude,
UTF8(payload) AS raw_payload
FROM events
WHERE
(
(
logsourcetypename(devicetype) ILIKE '%VMware%'
AND (
UTF8(payload) ILIKE '%segfault%'
OR UTF8(payload) ILIKE '%heap-buffer-overflow%'
OR UTF8(payload) ILIKE '%SIGSEGV%'
OR UTF8(payload) ILIKE '%core dump%'
OR UTF8(payload) ILIKE '%out of bounds%'
OR UTF8(payload) ILIKE '%DCERPC%'
OR UTF8(payload) ILIKE '%vpxd%crash%'
OR UTF8(payload) ILIKE '%CVE-2024-37079%'
)
)
OR
(
destinationport IN (443, 902, 5480, 9443)
AND destinationip INCIDR '0.0.0.0/0'
AND category = 'Application'
AND magnitude >= 6
)
)
AND LOGSOURCETIME(starttime) > NOW() - 1 HOURS
ORDER BY starttime DESC
LIMIT 1000QRadar AQL query identifying CVE-2024-37079 exploitation indicators via VMware log source payload analysis for memory corruption signals and high-magnitude events targeting vCenter management ports.
Data Sources
Required Tables
False Positives & Tuning
- VMware log sources generating high-magnitude events during scheduled maintenance windows
- Legitimate administrative RPC calls to vCenter that match DCERPC payload patterns
- Automated monitoring tools connecting to vCenter management ports triggering network activity rules
- Old or misconfigured integrations sending deprecated API calls that generate parse-error payloads
Other platforms for CVE-2024-37079
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate vCenter DCERPC Malformed Request (Lab Only)
Expected signal: Network flow log entry showing TCP connection attempt to target:135 with large payload; vCenter DCERPC service log entry showing parse error or malformed packet rejection
- Test 2Trigger vCenter vpxd Process Crash via Resource Exhaustion (Lab Only)
Expected signal: Syslog entry on vCenter appliance: vpxd[PID]: segfault at [address]; core dump file created at /var/core/vpxd-[timestamp].core
- Test 3Probe vCenter Management Ports from Unauthorized IP (Lab Only)
Expected signal: Firewall/network logs showing TCP SYN packets from scanner IP to vCenter management ports; vCenter access logs showing connection attempts to /ui, /sdk, VAMI endpoints
- Test 4Validate vCenter Log Forwarding and Crash Pattern Matching
Expected signal: Syslog message appearing in SIEM ingestion pipeline with process name vpxd and severity daemon.crit containing the synthetic crash string
Unlock Pro Content
Get the full detection package for CVE-2024-37079 including response playbook, investigation guide, and atomic red team tests.