Detect VMware vCenter Server Out-of-bounds Write (CVE-2024-37079) in Microsoft Sentinel
Detects exploitation attempts targeting CVE-2024-37079, an out-of-bounds write vulnerability (CWE-787) in Broadcom VMware vCenter Server. This KEV-listed vulnerability allows unauthenticated remote attackers to trigger memory corruption via malformed DCERPC requests to the vCenter management interface, potentially leading to remote code execution with SYSTEM-level privileges on the vCenter appliance.
MITRE ATT&CK
KQL Detection Query
let vcenter_ips = dynamic([]);
union
(
CommonSecurityLog
| where DeviceProduct has_any ("vCenter", "VMware vCenter")
| where Message has_any ("out-of-bounds", "heap corruption", "DCERPC", "vmdir", "vpxd crash", "core dump", "segfault")
| project TimeGenerated, DeviceAddress, SourceIP, DestinationIP, Message, Activity, DeviceProduct
),
(
Syslog
| where ProcessName in ("vpxd", "vmdir", "vmdird", "vmafdd")
| where SyslogMessage has_any ("segfault", "core dumped", "heap-buffer-overflow", "stack smashing", "SIGABRT", "SIGSEGV")
| project TimeGenerated, HostName, HostIP, ProcessName, SyslogMessage
),
(
AzureActivity
| where ResourceProviderValue =~ "Microsoft.AVS"
| where OperationNameValue has_any ("write", "update") and ActivityStatusValue =~ "Failed"
| project TimeGenerated, CallerIpAddress, ResourceGroup, OperationNameValue, ActivityStatusValue
),
(
CommonSecurityLog
| where DestinationPort in (443, 902, 5480, 9443)
| where DeviceVendor has_any ("VMware", "Broadcom")
| where Activity has_any ("exploit", "attack", "CVE-2024-37079")
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, Activity, Message
)
| sort by TimeGenerated descDetects indicators of CVE-2024-37079 exploitation against VMware vCenter Server by correlating vCenter process crashes, out-of-bounds memory errors, and anomalous DCERPC/management-port activity sourced from CommonSecurityLog and Syslog tables in Microsoft Sentinel.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate vCenter upgrades or patches that cause transient service restarts may trigger process crash signals
- Misconfigured third-party backup agents polling vCenter management APIs on non-standard schedules
- Internal vulnerability scanners (Tenable, Qualys) probing vCenter management ports during authorized assessments
- Hardware failures or resource exhaustion causing vCenter daemon crashes unrelated to exploitation
Other platforms for CVE-2024-37079
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate vCenter DCERPC Malformed Request (Lab Only)
Expected signal: Network flow log entry showing TCP connection attempt to target:135 with large payload; vCenter DCERPC service log entry showing parse error or malformed packet rejection
- Test 2Trigger vCenter vpxd Process Crash via Resource Exhaustion (Lab Only)
Expected signal: Syslog entry on vCenter appliance: vpxd[PID]: segfault at [address]; core dump file created at /var/core/vpxd-[timestamp].core
- Test 3Probe vCenter Management Ports from Unauthorized IP (Lab Only)
Expected signal: Firewall/network logs showing TCP SYN packets from scanner IP to vCenter management ports; vCenter access logs showing connection attempts to /ui, /sdk, VAMI endpoints
- Test 4Validate vCenter Log Forwarding and Crash Pattern Matching
Expected signal: Syslog message appearing in SIEM ingestion pipeline with process name vpxd and severity daemon.crit containing the synthetic crash string
Unlock Pro Content
Get the full detection package for CVE-2024-37079 including response playbook, investigation guide, and atomic red team tests.