CVE-2026-22719: VMware Aria Operations Command Injection

let AriaOpsProcesses = dynamic(['vmware-vcops', 'vcops', 'aria-ops', 'vrops']);
let SuspiciousChildProcs = dynamic(['sh', 'bash', 'python', 'python3', 'perl', 'curl', 'wget', 'nc', 'ncat', 'netcat', 'id', 'whoami', 'uname']);
let TimeWindow = 1h;
union DeviceProcessEvents, SecurityEvent
| where TimeGenerated > ago(TimeWindow)
| where (ParentProcessName has_any (AriaOpsProcesses) or ProcessCommandLine has_any ('aria', 'vrops', 'vcops'))
    and FileName has_any (SuspiciousChildProcs)
| extend CommandLength = strlen(ProcessCommandLine)
| where CommandLength > 20
| project TimeGenerated, DeviceName, AccountName, ParentProcessName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, RemoteIP, ActionType
| order by TimeGenerated desc

index=* sourcetype IN ("vmware:aria:log", "vmware:vcops:log", "linux:audit", "syslog") earliest=-1h
| eval parent_lower=lower(coalesce(parent_process, parentprocess, ppid_name))
| eval cmd_lower=lower(coalesce(command, cmd, process))
| where (match(parent_lower, "(?i)(vrops|vcops|aria|vmware-vcops)"))
    AND (match(cmd_lower, "(?i)(bash|sh|python|perl|curl|wget|ncat|netcat|whoami|id\b|uname)"))
| eval severity="critical"
| stats count AS exec_count, values(cmd_lower) AS commands, earliest(_time) AS first_seen, latest(_time) AS last_seen BY host, parent_lower, src_user
| where exec_count > 0
| sort - exec_count

sequence by host.name with maxspan=30s
  [process where event.type == "start"
    and process.name : ("vmware-vcops", "vcops-watchdog", "casa", "vmware-aria*")
    and process.parent.name != null]
  [process where event.type == "start"
    and process.name : ("sh", "bash", "python*", "perl", "curl", "wget", "nc", "ncat", "whoami", "id", "uname")
    and process.parent.name : ("vmware-vcops", "vcops-watchdog", "casa", "vmware-aria*")]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
       sourceip, destinationip, username,
       "Process Name" AS process_name,
       "Parent Process Name" AS parent_process,
       "Command" AS command_line
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Linux OS', 'VMware vRealize Operations Manager', 'Universal DSM')
  AND (LOWER("Parent Process Name") IMATCHES '.*(?:vrops|vcops|vmware-vcops|casa|aria).*')
  AND (LOWER("Process Name") IMATCHES '.*(bash|sh|python|perl|curl|wget|ncat|netcat|whoami|id|uname).*')
  AND starttime > NOW() - 3600000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=vmware/aria OR _sourceCategory=linux/audit OR _sourceCategory=syslog
| where _messagetime > now() - 3600000
| parse "parent=*" as parent_process nodrop
| parse "comm=*" as child_process nodrop
| parse "cmd=*" as command_line nodrop
| where matches(parent_process, "(?i)(?:vrops|vcops|aria|vmware-vcops|casa)")
  and matches(child_process, "(?i)(?:bash|sh|python|perl|curl|wget|ncat|netcat|whoami|id|uname)")
| count by _sourceHost, parent_process, child_process, command_line
| sort by _count desc

rule cve_2026_22719_aria_ops_command_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects command injection exploitation of CVE-2026-22719 in VMware Aria Operations via suspicious child process execution"
    severity = "CRITICAL"
    confidence = "MEDIUM"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-22719"

  events:
    $parent.metadata.event_type = "PROCESS_LAUNCH"
    $parent.principal.process.file.full_path = /(?i)(vrops|vcops|aria|vmware-vcops|casa)/ nocase
    $child.metadata.event_type = "PROCESS_LAUNCH"
    $child.principal.process.file.full_path = /(?i)(\bsh\b|bash|python|perl|curl|wget|ncat|netcat|whoami|\bid\b|uname)/ nocase
    $child.principal.process.parent_process.file.full_path = $parent.principal.process.file.full_path
    $parent.metadata.event_timestamp.seconds = $child.metadata.event_timestamp.seconds

  match:
    $child.principal.hostname over 30s

  outcome:
    $risk_score = 90
    $target_host = $child.principal.hostname
    $cmd = $child.principal.process.command_line

  condition:
    $parent and $child
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName IN ["vmware-vcops", "casa", "vcops-watchdog", "aria-ops"]
| FileName IN ["sh", "bash", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "netcat", "whoami", "id", "uname"]
| where timestamp > now() - 1h
| groupby([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(timestamp, order=desc)
| limit 200