Detect Dell RecoverPoint for Virtual Machines (RP4VMs) Hard-coded Credentials Exploitation in Microsoft Sentinel
Detects exploitation of CVE-2026-22769, a hard-coded credentials vulnerability in Dell RecoverPoint for Virtual Machines (RP4VMs). Threat actors (including UNC6201) have actively exploited this zero-day to gain unauthorized access to RP4VMs appliances, enabling lateral movement, data exfiltration, and ransomware deployment within virtualized environments. The hard-coded credentials allow unauthenticated remote access to RP4VMs management interfaces.
MITRE ATT&CK
KQL Detection Query
let rp4vm_ips = dynamic([]);
let hardcoded_users = dynamic(["admin", "support", "boxmgmt", "root", "service", "recover"]);
union
(
SigninLogs
| where TimeGenerated >= ago(7d)
| where AppDisplayName has_any ("RecoverPoint", "RP4VM", "Dell RecoverPoint")
| where ResultType == 0
| where UserPrincipalName has_any (hardcoded_users)
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, Location, DeviceDetail, AuthenticationDetails
| extend AlertReason = "Successful login using known RP4VMs default/hardcoded username"
),
(
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DeviceVendor =~ "Dell" or DeviceProduct has_any ("RecoverPoint", "RP4VM")
| where Activity has_any ("login", "authentication", "ssh", "console")
| where SourceUserName has_any (hardcoded_users)
| project TimeGenerated, SourceIP, SourceUserName, DeviceProduct, Activity, Message
| extend AlertReason = "RP4VMs appliance authentication event with suspected hard-coded credential username"
),
(
Syslog
| where TimeGenerated >= ago(7d)
| where Computer has_any ("recoverpoint", "rp4vm", "rpa")
| where SyslogMessage has_any ("Accepted password", "Accepted publickey", "session opened") and SyslogMessage has_any (hardcoded_users)
| project TimeGenerated, Computer, HostIP, SyslogMessage, ProcessName
| extend AlertReason = "SSH session opened on RP4VMs appliance using suspected hard-coded credential"
),
(
AzureActivity
| where TimeGenerated >= ago(7d)
| where OperationNameValue has_any ("Microsoft.RecoveryServices", "backup", "replication")
| where ActivityStatusValue == "Success"
| where Caller has_any (hardcoded_users)
| project TimeGenerated, Caller, CallerIpAddress, OperationNameValue, ResourceGroup
| extend AlertReason = "Azure recovery services operation by suspected hard-coded credential account"
)
| order by TimeGenerated descDetects authentication events against Dell RP4VMs appliances using known default or hard-coded usernames across SigninLogs, CommonSecurityLog, Syslog, and AzureActivity. Surfaces successful logins, SSH sessions, and management operations consistent with CVE-2026-22769 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrators using default usernames that have not been renamed post-deployment
- Automated backup or replication jobs configured with service accounts sharing names with known defaults
- Vendor support sessions initiated by Dell engineers using documented service credentials
- Integration scripts or orchestration platforms authenticating with default credentials prior to hardening
Other platforms for CVE-2026-22769
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1RP4VMs Default Credential SSH Authentication Simulation
Expected signal: SSH authentication event in /var/log/auth.log on the target RP4VMs appliance showing 'Accepted password for admin from <attacker_ip>'. SIEM should receive this via syslog forwarding from the appliance.
- Test 2RP4VMs Post-Exploitation Command Execution via Hard-coded Credentials
Expected signal: SSH session opened for user 'support' followed by process execution events (cat, ps, netstat/ss, find) visible in Auditd or Falco telemetry if deployed on the RP4VMs Linux host.
- Test 3RP4VMs Credential Discovery — Searching for Additional Credentials Post-Compromise
Expected signal: Auditd EXECVE syscall events for grep, cat, and env commands executed under the 'boxmgmt' user context on the RP4VMs host. File access events for /etc directory traversal.
- Test 4RP4VMs Persistence — Unauthorized SSH Key Installation
Expected signal: File write event to ~/.ssh/authorized_keys under the 'admin' user account on the RP4VMs host. Auditd or Falco should capture the open/write syscalls against the authorized_keys file path.
References (4)
- https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079
- https://www.dell.com/support/kbdoc/en-us/000426742/recoverpoint-for-vms-apply-the-remediation-script-for-dsa
- https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day
- https://nvd.nist.gov/vuln/detail/CVE-2026-22769
Unlock Pro Content
Get the full detection package for CVE-2026-22769 including response playbook, investigation guide, and atomic red team tests.