Branch was auto-updated.

detections/web/vmware_aria_operations_exploit_attempt.yml

@@ -0,0 +1,73 @@
+name: VMWare Aria Operations Exploit Attempt
+id: d5d865e4-03e6-43da-98f4-28a4f42d4df7
+version: 1
+date: '2023-06-21'
+author: Michael Haag, Splunk
+status: production
+type: TTP
+data_source: []
+description: The following analytic is designed to detect potential exploitation attempts against VMWare vRealize Network Insight that align with the characteristics of CVE-2023-20887. This specific vulnerability is a critical security flaw that, if exploited, could allow an attacker to execute arbitrary code on the affected system.\
+
+  The analytic operates by monitoring web traffic, specifically HTTP POST requests, directed towards a specific URL endpoint ("/saas./resttosaasservlet"). This endpoint is known to be vulnerable and is a common target for attackers exploiting this vulnerability.\
+
+  The behavior this analytic detects is the sending of HTTP POST requests to the vulnerable endpoint. This is a significant indicator of an attempted exploit as it is the primary method used to trigger the vulnerability. The analytic detects this behavior by analyzing web traffic data and identifying HTTP POST requests directed at the vulnerable endpoint.\
+
+  Identifying this behavior is crucial for a Security Operations Center (SOC) as it can indicate an active attempt to exploit a known vulnerability within the network. If the identified behavior is a true positive, it suggests an attacker is attempting to exploit the CVE-2023-20887 vulnerability in VMWare vRealize Network Insight. The impact of such an attack could be severe, potentially allowing the attacker to execute arbitrary code on the affected system, leading to unauthorized access, data theft, or further propagation within the network.
+search: '| tstats count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Web where Web.url IN ("*/saas./resttosaasservlet*")  Web.http_method=POST Web.status IN ("unknown", "200")
+  by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` | `vmware_aria_operations_exploit_attempt_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  web or proxy logs, or ensure it is being filled by a proxy like device, into the
+  Web Datamodel. Restrict to specific dest assets to reduce false positives.
+known_false_positives: False positives will be present based on gateways in use, modify the status field as needed.
+references:
+- https://nvd.nist.gov/vuln/detail/CVE-2023-20887
+- https://viz.greynoise.io/tag/vmware-aria-operations-for-networks-rce-attempt?days=30
+- https://github.com/sinsinology/CVE-2023-20887
+- https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/
+tags:
+  CVE:
+  - CVE-2023-20887
+  analytic_story:
+  - VMware Aria Operations vRealize CVE-2023-20887
+  asset_type: Web Server
+  atomic_guid: []
+  confidence: 80
+  impact: 90
+  message: An exploitation attempt has occurred against $dest$ from $src$ related to CVE-2023-20887
+  mitre_attack_id:
+  - T1133
+  - T1190
+  - T1210
+  - T1068
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 72
+  required_fields:
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  - Web.http_user_agent
+  security_domain: network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/vmware/vmware_aria.log
+    source: pan:threat
+    sourcetype: pan:threat

stories/vmware_aria_operations_vrealize_cve_2023_20887.yml

@@ -0,0 +1,29 @@
+name: VMware Aria Operations vRealize CVE-2023-20887
+id: 99171cdd-57a1-4b8a-873c-f8bee12e2025
+version: 1
+date: '2023-06-21'
+author: Michael Haag, Splunk
+description: CVE-2023-20887 is a critical vulnerability affecting VMware's vRealize Network Insight (also known as VMware Aria Operations for Networks). It allows a remote, unauthenticated attacker to execute arbitrary commands with root privileges via the Apache Thrift RPC interface. The exploit, which has a severity score of 9.8, targets an endpoint ("/saas./resttosaasservlet") in the application and delivers a malicious payload designed to create a reverse shell, granting the attacker control over the system. VMware has released an advisory recommending users to update to the latest version to mitigate this threat.
+narrative: CVE-2023-20887 is a highly critical vulnerability found in VMware's vRealize Network Insight. This software is widely used for intelligent operations management across physical, virtual, and cloud environments, so a vulnerability in it poses a significant risk to many organizations.\
+
+  This particular vulnerability lies in the application's Apache Thrift RPC interface. The exploit allows an attacker to inject commands that are executed with root privileges, leading to a potential total compromise of the system. The attacker does not need to be authenticated, which further increases the risk posed by this vulnerability.\
+
+  The exploit operates by sending a specially crafted payload to the "/saas./resttosaasservlet" endpoint. This payload contains a reverse shell command, which, when executed, allows the attacker to remotely control the victim's system. This control is obtained at the root level, providing the attacker with the ability to perform any action on the system.\
+
+  What makes this vulnerability particularly dangerous is its high severity score of 9.8, indicating it is a critical threat. It's also noteworthy that the exploitation of this vulnerability leaves specific indicators such as abnormal traffic to the "/saas./resttosaasservlet" endpoint and suspicious ncat commands in network traffic, which can help in its detection.\
+
+  VMware has acknowledged the vulnerability and has published a security advisory recommending that users update to the latest version of the software. This update effectively patches the vulnerability and protects systems from this exploit. It's crucial that all users of the affected versions of VMware's vRealize Network Insight promptly apply the update to mitigate the risk posed by CVE-2023-20887.
+references:
+- https://nvd.nist.gov/vuln/detail/CVE-2023-20887
+- https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/
+- https://viz.greynoise.io/tag/VMware-aria-operations-for-networks-rce-attempt?days=30
+- https://github.com/sinsinology/CVE-2023-20887
+tags:
+  analytic_story: VMware Aria Operations vRealize CVE-2023-20887
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection