Detect VMware vCenter Server Out-of-bounds Write (CVE-2024-37079) in Splunk
Detects exploitation attempts targeting CVE-2024-37079, an out-of-bounds write vulnerability (CWE-787) in Broadcom VMware vCenter Server. This KEV-listed vulnerability allows unauthenticated remote attackers to trigger memory corruption via malformed DCERPC requests to the vCenter management interface, potentially leading to remote code execution with SYSTEM-level privileges on the vCenter appliance.
MITRE ATT&CK
SPL Detection Query
index=* sourcetype IN ("vmware:vcenter:log", "vmware:esxi:syslog", "linux_secure", "syslog", "cisco:asa", "pan:traffic")
(host=*vcenter* OR host=*vcs* OR host=*vc[0-9]*)
(
(
(source="/var/log/vmware/vpxd/vpxd.log" OR source="/var/log/vmware/vmdird/vmdird.log")
("segfault" OR "core dump" OR "heap-buffer-overflow" OR "SIGABRT" OR "SIGSEGV" OR "out of bounds" OR "stack smashing detected")
)
OR
(
sourcetype IN ("cisco:asa", "pan:traffic", "juniper:junos:firewall")
dest_port IN (443, 902, 5480, 9443)
("CVE-2024-37079" OR "exploit" OR "scanner")
)
OR
(
sourcetype="vmware:vcenter:log"
("DCERPC" OR "RPC fault" OR "malformed request" OR "unexpected token" OR "parse error")
)
)
| eval severity=case(
match(_raw, "segfault|SIGSEGV|heap-buffer-overflow|core dump"), "critical",
match(_raw, "DCERPC|RPC fault|malformed request"), "high",
true(), "medium"
)
| stats count AS event_count, values(severity) AS severities, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(src_ip) AS source_ips BY host, source, sourcetype
| where event_count > 0
| sort - last_seenSplunk query correlating VMware vCenter daemon crash signals, out-of-bounds memory errors in vCenter logs, and suspicious inbound traffic to vCenter management ports to surface CVE-2024-37079 exploitation attempts.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Authorized vulnerability scans against vCenter management interfaces generating parse-error log entries
- vCenter service restarts during patch windows producing crash-like log signatures
- Misconfigured monitoring agents sending malformed health-check requests to vCenter APIs
- Third-party integrations (backup, orchestration) with incompatible API versions producing RPC fault entries
Other platforms for CVE-2024-37079
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate vCenter DCERPC Malformed Request (Lab Only)
Expected signal: Network flow log entry showing TCP connection attempt to target:135 with large payload; vCenter DCERPC service log entry showing parse error or malformed packet rejection
- Test 2Trigger vCenter vpxd Process Crash via Resource Exhaustion (Lab Only)
Expected signal: Syslog entry on vCenter appliance: vpxd[PID]: segfault at [address]; core dump file created at /var/core/vpxd-[timestamp].core
- Test 3Probe vCenter Management Ports from Unauthorized IP (Lab Only)
Expected signal: Firewall/network logs showing TCP SYN packets from scanner IP to vCenter management ports; vCenter access logs showing connection attempts to /ui, /sdk, VAMI endpoints
- Test 4Validate vCenter Log Forwarding and Crash Pattern Matching
Expected signal: Syslog message appearing in SIEM ingestion pipeline with process name vpxd and severity daemon.crit containing the synthetic crash string
Unlock Pro Content
Get the full detection package for CVE-2024-37079 including response playbook, investigation guide, and atomic red team tests.