Detect VMware vCenter Server Out-of-bounds Write (CVE-2024-37079) in Sumo Logic CSE
Detects exploitation attempts targeting CVE-2024-37079, an out-of-bounds write vulnerability (CWE-787) in Broadcom VMware vCenter Server. This KEV-listed vulnerability allows unauthenticated remote attackers to trigger memory corruption via malformed DCERPC requests to the vCenter management interface, potentially leading to remote code execution with SYSTEM-level privileges on the vCenter appliance.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=*vmware* OR _sourceCategory=*vcenter*
| parse "*" as raw_message
| where raw_message matches /segfault|heap-buffer-overflow|SIGSEGV|SIGABRT|core dump(ed)?|stack smashing|out.of.bounds|DCERPC|RPC fault|malformed request|CVE-2024-37079/ OR
(_sourceCategory matches /firewall|network|palo_alto|cisco_asa/ and (raw_message matches /:(443|902|5480|9443)/ and raw_message matches /vcenter|vcs/))
| extract "(?P<process>vpxd|vmdir|vmdird|vmafdd|vmcad)" from raw_message nodrop
| extract "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" from raw_message nodrop
| eval crash_indicator = if(raw_message matches /segfault|SIGSEGV|core dump|heap-buffer-overflow/, "true", "false")
| eval rpc_indicator = if(raw_message matches /DCERPC|RPC fault|malformed request/, "true", "false")
| timeslice 5m
| stats count as event_count, count_distinct(src_ip) as unique_sources, values(process) as affected_processes, sum(if(crash_indicator="true",1,0)) as crash_events, sum(if(rpc_indicator="true",1,0)) as rpc_events by _timeslice, _sourceHost
| where event_count > 0
| sort by _timeslice descSumo Logic query aggregating vCenter memory corruption crash signals and anomalous DCERPC/RPC fault entries across 5-minute windows to detect CVE-2024-37079 exploitation patterns.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled vCenter backup agents triggering process activity that resembles crash patterns
- vCenter API version mismatches with older integrations generating malformed request log entries
- Burst network activity from authorized vSphere client pools scanning management interfaces
- Log forwarding delays causing time-windowed aggregation to overcount single events
Other platforms for CVE-2024-37079
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate vCenter DCERPC Malformed Request (Lab Only)
Expected signal: Network flow log entry showing TCP connection attempt to target:135 with large payload; vCenter DCERPC service log entry showing parse error or malformed packet rejection
- Test 2Trigger vCenter vpxd Process Crash via Resource Exhaustion (Lab Only)
Expected signal: Syslog entry on vCenter appliance: vpxd[PID]: segfault at [address]; core dump file created at /var/core/vpxd-[timestamp].core
- Test 3Probe vCenter Management Ports from Unauthorized IP (Lab Only)
Expected signal: Firewall/network logs showing TCP SYN packets from scanner IP to vCenter management ports; vCenter access logs showing connection attempts to /ui, /sdk, VAMI endpoints
- Test 4Validate vCenter Log Forwarding and Crash Pattern Matching
Expected signal: Syslog message appearing in SIEM ingestion pipeline with process name vpxd and severity daemon.crit containing the synthetic crash string
Unlock Pro Content
Get the full detection package for CVE-2024-37079 including response playbook, investigation guide, and atomic red team tests.