Detect CVE-2025-41244 - VMware Aria Operations & VMware Tools Privilege Escalation via Unsafe Actions in Microsoft Sentinel
Detects exploitation of CVE-2025-41244, a privilege escalation vulnerability in Broadcom VMware Aria Operations and VMware Tools caused by privileges defined with unsafe actions (CWE-267). This KEV-listed vulnerability allows attackers with lower-privileged access to escalate privileges by abusing overly permissive or unsafe role/action definitions within VMware Aria Operations or VMware Tools components. Indicators include anomalous administrative API calls, unexpected privilege changes in VMware management interfaces, and suspicious process activity from VMware Tools guest utilities.
MITRE ATT&CK
- Tactic
- Privilege Escalation Persistence
KQL Detection Query
let timeWindow = 1h;
union
(
AzureActivity
| where TimeGenerated >= ago(timeWindow)
| where OperationNameValue has_any ("VMware", "Aria", "vROps")
| where ActivityStatusValue == "Success"
| where Caller !in~ ("known-service-accounts")
| extend ParsedProps = parse_json(Properties)
| where tostring(ParsedProps.requestbody) has_any ("roleAssignment", "privilege", "permission", "adminRole")
| project TimeGenerated, Caller, OperationNameValue, ResourceGroup, Resource, ActivityStatusValue, Properties
),
(
SecurityEvent
| where TimeGenerated >= ago(timeWindow)
| where EventID in (4672, 4673, 4674, 4728, 4732, 4756)
| where Process has_any ("vmtoolsd.exe", "vmwaretray.exe", "vmwareuser.exe", "vmware-vmx", "vrops", "aria")
| project TimeGenerated, Account, Process, EventID, Computer, SubjectUserName, SubjectDomainName
),
(
DeviceProcessEvents
| where TimeGenerated >= ago(timeWindow)
| where InitiatingProcessFileName has_any ("vmtoolsd.exe", "vmwareuser.exe", "vmwaretray.exe")
| where ProcessCommandLine has_any ("SeDebugPrivilege", "SeTcbPrivilege", "SeImpersonatePrivilege", "net localgroup", "whoami /priv", "runas")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine, InitiatingProcessCommandLine
)
| order by TimeGenerated descDetects suspicious privilege-related activity associated with VMware Aria Operations and VMware Tools processes, including anomalous administrative role assignments and privilege escalation patterns in security events and device process telemetry.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate VMware administrators performing authorized role assignments or configuration changes in Aria Operations
- VMware Tools updates or patches that trigger process privilege events during installation
- Automated service accounts performing scheduled VMware management tasks
- Security scanning tools enumerating VMware privileges during authorized assessments
Other platforms for CVE-2025-41244
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1VMware Tools Privilege Enumeration via vmtoolsd
Expected signal: DeviceProcessEvents showing schtasks.exe creating a task, followed by whoami.exe execution with SYSTEM context; Security Event 4672 (Special Logon for SYSTEM) and 4698 (Scheduled Task Created)
- Test 2Aria Operations Role Assignment via Unauthenticated or Low-Privilege API Call
Expected signal: VMware Aria Operations audit log entries recording the role assignment API call with the low-privilege token identity; HTTP 200 response on a vulnerable instance vs 403 on a patched instance
- Test 3VMware Tools Guest-to-Host Privilege Escalation Simulation
Expected signal: Linux auditd logs showing vmware-toolsd process activity and /dev/vmci access; VMware Tools log at /var/log/vmware-vmsvc-root.log recording guest operation invocations
Unlock Pro Content
Get the full detection package for CVE-2025-41244 including response playbook, investigation guide, and atomic red team tests.