VMWARE VCenter VMSA CVE-2021-0027 Detection Scenario by crowdsecurity | CrowdSec Hub

VMWARE VCenter VMSA CVE-2021-0027

Attack scenariovm-management:exploitMITRE T1190MITRE T1595cve.CVE-2021-0027

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/vmware-vcenter-vmsa-2021-0027
Remediation: Ban

Detect VMSA-2021-0027 exploitation attempts

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/vmware-vcenter-vmsa-2021-0027

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/vmware-vcenter-vmsa-2021-0027.yaml· 19 linesGitHub

1type: trigger1
2format: 2.0
3name: crowdsecurity/vmware-vcenter-vmsa-2021-0027
4description: "Detect VMSA-2021-0027 exploitation attempts"
5filter: |2
6  evt.Meta.log_type in ['http_access-log', 'http_error-log'] && evt.Meta.http_path matches '/ui/vcav-bootstrap/rest/vcav-providers/provider-logo\\?url=(file|http)'
7groupby: "evt.Meta.source_ip"3
8blackhole: 2m4
9labels:
10  confidence: 3
11  spoofable: 0
12  classification:5
13    - attack.T1190
14    - attack.T1595
15    - cve.CVE-2021-0027
16  behavior: "vm-management:exploit"
17  label: "VMWARE VCenter VMSA CVE-2021-0027"
18  remediation: true6
19  service: vmware

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect exploitation of VMSA-2021-0027

Ref: https://www.vmware.com/security/advisories/VMSA-2021-0027.html