Dell RecoverPoint for Virtual Machines (RP4VMs) Hard-coded Credentials Exploitation

let rp4vm_ips = dynamic([]);
let hardcoded_users = dynamic(["admin", "support", "boxmgmt", "root", "service", "recover"]);
union
(
    SigninLogs
    | where TimeGenerated >= ago(7d)
    | where AppDisplayName has_any ("RecoverPoint", "RP4VM", "Dell RecoverPoint")
    | where ResultType == 0
    | where UserPrincipalName has_any (hardcoded_users)
    | project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, Location, DeviceDetail, AuthenticationDetails
    | extend AlertReason = "Successful login using known RP4VMs default/hardcoded username"
),
(
    CommonSecurityLog
    | where TimeGenerated >= ago(7d)
    | where DeviceVendor =~ "Dell" or DeviceProduct has_any ("RecoverPoint", "RP4VM")
    | where Activity has_any ("login", "authentication", "ssh", "console")
    | where SourceUserName has_any (hardcoded_users)
    | project TimeGenerated, SourceIP, SourceUserName, DeviceProduct, Activity, Message
    | extend AlertReason = "RP4VMs appliance authentication event with suspected hard-coded credential username"
),
(
    Syslog
    | where TimeGenerated >= ago(7d)
    | where Computer has_any ("recoverpoint", "rp4vm", "rpa")
    | where SyslogMessage has_any ("Accepted password", "Accepted publickey", "session opened") and SyslogMessage has_any (hardcoded_users)
    | project TimeGenerated, Computer, HostIP, SyslogMessage, ProcessName
    | extend AlertReason = "SSH session opened on RP4VMs appliance using suspected hard-coded credential"
),
(
    AzureActivity
    | where TimeGenerated >= ago(7d)
    | where OperationNameValue has_any ("Microsoft.RecoveryServices", "backup", "replication")
    | where ActivityStatusValue == "Success"
    | where Caller has_any (hardcoded_users)
    | project TimeGenerated, Caller, CallerIpAddress, OperationNameValue, ResourceGroup
    | extend AlertReason = "Azure recovery services operation by suspected hard-coded credential account"
)
| order by TimeGenerated desc

index=* sourcetype IN ("dell:recoverpoint", "linux_secure", "syslog", "cisco:asa", "pan:traffic")
(
  (
    ("Accepted password" OR "Accepted publickey" OR "session opened for user")
    AND ("admin" OR "support" OR "boxmgmt" OR "root" OR "service" OR "recover")
    AND (host="*recoverpoint*" OR host="*rp4vm*" OR host="*rpa*")
  )
  OR
  (
    sourcetype="dell:recoverpoint"
    AND (action="login" OR action="authenticate" OR action="ssh_connect")
    AND (user="admin" OR user="support" OR user="boxmgmt" OR user="service")
  )
)
| eval risk_reason=case(
    match(_raw, "Accepted password"), "Password-based auth on RP4VMs - potential hardcoded cred use",
    match(_raw, "session opened"), "Interactive session on RP4VMs appliance",
    true(), "RP4VMs authentication event"
  )
| eval severity="critical"
| table _time, host, src_ip, user, action, risk_reason, severity, _raw
| sort -_time

sequence by host.hostname with maxspan=5m
  [authentication where
    host.hostname like~ "*recoverpoint*" or host.hostname like~ "*rp4vm*" or host.hostname like~ "*rpa*"
    and user.name in ("admin", "support", "boxmgmt", "root", "service", "recover")
    and event.outcome == "success"
  ] by user.name
  [process where
    host.hostname like~ "*recoverpoint*" or host.hostname like~ "*rp4vm*"
    and event.type == "start"
    and process.name in ("bash", "sh", "python", "python3", "curl", "wget", "nc", "ncat")
  ] by user.name

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  USERNAME,
  QIDNAME(qid) AS event_name,
  LOGSOURCENAME(logsourceid) AS log_source,
  UTF8(payload) AS raw_payload
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Dell RecoverPoint', 'Linux OS', 'Universal DSM')
  AND (
    USERNAME IN ('admin', 'support', 'boxmgmt', 'root', 'service', 'recover')
    OR UTF8(payload) ILIKE '%Accepted password%'
    OR UTF8(payload) ILIKE '%Accepted publickey%'
    OR UTF8(payload) ILIKE '%session opened%'
  )
  AND (
    LOGSOURCENAME(logsourceid) ILIKE '%recoverpoint%'
    OR LOGSOURCENAME(logsourceid) ILIKE '%rp4vm%'
    OR destinationip IN (SELECT value FROM reference_table('RP4VMs_Asset_IPs'))
  )
  AND eventdirection = 'R2L'
  AND CATEGORYNAME(category) IN ('Authentication Success', 'User Login', 'Remote Access')
ORDER BY starttime DESC
LAST 7 DAYS

_sourceCategory=*recoverpoint* OR _sourceCategory=*rp4vm* OR _sourceHost=*recoverpoint* OR _sourceHost=*rp4vm*
| where _raw matches /Accepted (password|publickey)|session opened|authentication success/i
| parse regex "(?:for user|user=|USER=)\s*(?P<username>\S+)"
| where username in ("admin", "support", "boxmgmt", "root", "service", "recover")
| parse regex "from\s+(?P<src_ip>[\d\.]+)"
| timeslice 1h
| count by _timeslice, username, src_ip, _sourceHost
| where _count > 0
| sort by _timeslice desc
| fields _timeslice, username, src_ip, _sourceHost, _count

rule dell_rp4vms_hardcoded_creds_cve_2026_22769 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-22769 exploitation via hard-coded credentials in Dell RP4VMs"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    $auth.metadata.event_type = "USER_LOGIN"
    $auth.security_result.action = "ALLOW"
    $auth.target.user.userid in (
      "admin", "support", "boxmgmt", "root", "service", "recover"
    )
    (
      $auth.target.hostname = /(?i)(recoverpoint|rp4vm|rpa\d)/
      or $auth.target.asset.asset_id = /(?i)(recoverpoint|rp4vm)/
    )
    $auth.principal.ip = $src_ip

  match:
    $src_ip over 1h

  condition:
    #auth > 0
}

#event_simpleName IN ("UserLogon", "UserLogonFailed2", "ProcessRollup2", "NetworkConnectIP4")
| UserName IN ["admin", "support", "boxmgmt", "root", "service", "recover"]
| ComputerName MATCHES "(?i)(recoverpoint|rp4vm|rpa\\d)"
| LogonType_decimal IN [3, 10, 11]
| Success_decimal = 1
| groupBy([ComputerName, UserName, RemoteAddressIP4, LogonType_decimal], function=count(aid, as=event_count))
| sort(event_count, order=desc)
| rename RemoteAddressIP4 as source_ip
| rename LogonType_decimal as logon_type