CVE-2025-41244 - VMware Aria Operations & VMware Tools Privilege Escalation via Unsafe Actions

let timeWindow = 1h;
union
(
  AzureActivity
  | where TimeGenerated >= ago(timeWindow)
  | where OperationNameValue has_any ("VMware", "Aria", "vROps")
  | where ActivityStatusValue == "Success"
  | where Caller !in~ ("known-service-accounts")
  | extend ParsedProps = parse_json(Properties)
  | where tostring(ParsedProps.requestbody) has_any ("roleAssignment", "privilege", "permission", "adminRole")
  | project TimeGenerated, Caller, OperationNameValue, ResourceGroup, Resource, ActivityStatusValue, Properties
),
(
  SecurityEvent
  | where TimeGenerated >= ago(timeWindow)
  | where EventID in (4672, 4673, 4674, 4728, 4732, 4756)
  | where Process has_any ("vmtoolsd.exe", "vmwaretray.exe", "vmwareuser.exe", "vmware-vmx", "vrops", "aria")
  | project TimeGenerated, Account, Process, EventID, Computer, SubjectUserName, SubjectDomainName
),
(
  DeviceProcessEvents
  | where TimeGenerated >= ago(timeWindow)
  | where InitiatingProcessFileName has_any ("vmtoolsd.exe", "vmwareuser.exe", "vmwaretray.exe")
  | where ProcessCommandLine has_any ("SeDebugPrivilege", "SeTcbPrivilege", "SeImpersonatePrivilege", "net localgroup", "whoami /priv", "runas")
  | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine, InitiatingProcessCommandLine
)
| order by TimeGenerated desc

index=* sourcetype IN ("vmware:vcenter:events", "vmware:aria:audit", "WinEventLog:Security", "xmlwineventlog:security", "vmware:tools")
| eval is_vmware_proc = if(like(lower(process), "%vmtoolsd%") OR like(lower(process), "%vmwareuser%") OR like(lower(process), "%vmwaretray%") OR like(lower(source), "%aria%") OR like(lower(source), "%vrops%"), 1, 0)
| eval is_priv_event = if(EventCode IN ("4672", "4673", "4674", "4728", "4732", "4756") OR like(lower(action), "%privilege%") OR like(lower(action), "%role%assign%") OR like(lower(message), "%unsafe%action%"), 1, 0)
| where is_vmware_proc=1 OR is_priv_event=1
| eval risk_score = case(
    is_vmware_proc=1 AND is_priv_event=1, 90,
    is_vmware_proc=1, 50,
    is_priv_event=1, 40,
    true(), 10
  )
| where risk_score >= 50
| stats count as event_count, max(risk_score) as max_risk, values(action) as actions, values(EventCode) as event_codes, dc(src_ip) as unique_sources by user, host, _time
| where event_count >= 1
| sort - max_risk
| table _time, user, host, event_count, max_risk, actions, event_codes, unique_sources

sequence by host.name with maxspan=10m
  [process where event.type == "start"
   and process.name : ("vmtoolsd.exe", "vmwareuser.exe", "vmwaretray.exe", "vmware-vmx", "vrops-*")
  ]
  [any where
   (
     (event.category == "iam" and event.action : ("user-roles-changed", "role-added", "privilege-assigned"))
     or
     (event.category == "process" and process.command_line : ("*SeDebugPrivilege*", "*SeTcbPrivilege*", "*SeImpersonatePrivilege*", "*net localgroup*"))
     or
     (event.category == "authentication" and event.outcome == "success" and user.target.name != user.name)
   )
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  username,
  QIDNAME(qid) AS event_name,
  category,
  magnitude,
  "Application" AS app,
  UTF8(payload) AS raw_payload
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('VMware vCenter', 'VMware Aria Operations', 'Microsoft Windows Security Event Log')
  AND (
    ("Application" ILIKE '%vmtoolsd%'
     OR "Application" ILIKE '%vmwareuser%'
     OR "Application" ILIKE '%aria%'
     OR "Application" ILIKE '%vrops%')
    OR
    (CATEGORYNAME(category) ILIKE '%privilege%'
     AND (eventid IN (4672, 4673, 4674, 4728, 4732, 4756)))
    OR
    (UTF8(payload) ILIKE '%unsafe%action%'
     OR UTF8(payload) ILIKE '%roleAssignment%'
     OR UTF8(payload) ILIKE '%privilege%escalat%')
  )
  AND starttime > NOW() - 3600000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=vmware* OR _sourceCategory=windows/security
| parse regex field=_raw "(?P<event_type>vmtoolsd|vmwareuser|vmwaretray|aria|vrops)" nodrop
| parse regex field=_raw "EventCode=(?P<event_code>\d+)" nodrop
| parse regex field=_raw "(?i)(?P<priv_keyword>privilege|roleAssignment|unsafe.action|SeTcbPrivilege|SeDebugPrivilege|SeImpersonatePrivilege)" nodrop
| where !isNull(event_type) OR event_code in ("4672", "4673", "4674", "4728", "4732", "4756")
| eval risk = if(!isNull(event_type) AND !isNull(priv_keyword), "HIGH",
               if(!isNull(event_type), "MEDIUM",
               if(!isNull(priv_keyword), "MEDIUM", "LOW")))
| where risk in ("HIGH", "MEDIUM")
| timeslice 5m
| stats count as event_count, values(event_type) as vmware_processes, values(priv_keyword) as priv_keywords, values(event_code) as event_codes by _timeslice, _sourceHost, risk
| order by _timeslice desc

rule cve_2025_41244_vmware_privilege_escalation {
  meta:
    author = "df00tech"
    description = "Detects CVE-2025-41244 exploitation - VMware Aria Operations and VMware Tools privilege escalation via unsafe actions"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-41244"
    cve = "CVE-2025-41244"

  events:
    (
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      AND (
        re.regex($e1.principal.process.file.full_path, `(?i)(vmtoolsd|vmwareuser|vmwaretray|vrops|aria)`) OR
        re.regex($e1.target.process.file.full_path, `(?i)(vmtoolsd|vmwareuser|vmwaretray|vrops|aria)`)
      )
    )
    AND
    (
      $e2.metadata.event_type = "USER_CHANGE_PERMISSIONS"
      OR (
        $e2.metadata.event_type = "WINDOWS_EVENTLOG"
        AND $e2.metadata.product_event_type IN ("4672", "4673", "4674", "4728", "4732", "4756")
      )
    )
    AND $e1.principal.hostname = $e2.principal.hostname
    AND $e1.metadata.event_timestamp.seconds <= $e2.metadata.event_timestamp.seconds
    AND $e2.metadata.event_timestamp.seconds <= $e1.metadata.event_timestamp.seconds + 600

  condition:
    $e1 and $e2
}

#event_simpleName IN ("ProcessRollup2", "UserAccountAddedToGroup", "UserPrivilegeEscalation", "NetworkConnectIP4")
| FileName IN ("vmtoolsd.exe", "vmwareuser.exe", "vmwaretray.exe") OR CommandLine = /(?i)(vrops|aria|roleAssignment|SeTcbPrivilege|SeDebugPrivilege|SeImpersonatePrivilege|net localgroup administrators)/
| eval risk_indicator = case(
    FileName IN ("vmtoolsd.exe", "vmwareuser.exe", "vmwaretray.exe") AND CommandLine = /(?i)(SeDebugPrivilege|SeTcbPrivilege|SeImpersonatePrivilege)/, "CRITICAL_PRIV_ABUSE",
    FileName IN ("vmtoolsd.exe", "vmwareuser.exe", "vmwaretray.exe") AND CommandLine = /(?i)(net localgroup|whoami \/priv|runas)/, "SUSPICIOUS_ENUM",
    #event_simpleName = "UserAccountAddedToGroup" AND ParentBaseFileName IN ("vmtoolsd.exe", "vmwareuser.exe"), "GROUP_ADD_FROM_VMTOOLS",
    true(), "INFO"
  )
| where risk_indicator IN ("CRITICAL_PRIV_ABUSE", "SUSPICIOUS_ENUM", "GROUP_ADD_FROM_VMTOOLS")
| stats count() AS event_count, values(CommandLine) AS commands, values(risk_indicator) AS risk_indicators BY aid, ComputerName, UserName, FileName
| sort - event_count