cscli scenarios install crowdsecurity/vmware-vcenter-vmsa-2021-0027Detect exploitation of VMSA-2021-0027
Ref: https://www.vmware.com/security/advisories/VMSA-2021-0027.html
1type: trigger2format: 2.03name: crowdsecurity/vmware-vcenter-vmsa-2021-00274description: "Detect VMSA-2021-0027 exploitation attempts"5filter: |6 evt.Meta.log_type in ['http_access-log', 'http_error-log'] && evt.Meta.http_path matches '/ui/vcav-bootstrap/rest/vcav-providers/provider-logo\\?url=(file|http)'7groupby: "evt.Meta.source_ip"8blackhole: 2m9labels:10 confidence: 311 spoofable: 012 classification:13 - attack.T119014 - attack.T159515 - cve.CVE-2021-002716 behavior: "vm-management:exploit"17 label: "VMWARE VCenter VMSA CVE-2021-0027"18 remediation: true19 service: vmware20