CVE-2020-3992

Sentinel/Defender KQL

DeviceNetworkEvents
| where RemotePort == 427 and InitiatingProcessFileName contains "slpd"
| join kind=inner (DeviceProcessEvents
    | where InitiatingProcessParentFileName contains "slpd" and FileName in ("sh", "bash", "powershell.exe", "cmd.exe")
    | project DeviceId, Timestamp, InitiatingProcessCommandLine, FileName
) on DeviceId
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, InitiatingProcessCommandLine, FileName

Splunk SPL

index=* (dest_port=427 OR port=427) (process_name="slpd" OR process="slpd")
| join type=inner _time
    [ search index=* parent_process_name="slpd" (process_name="sh" OR process_name="bash" OR process_name="powershell.exe" OR process_name="cmd.exe")
    | fields _time, host, process, command_line ]
| table _time, host, process_name, dest_ip, dest_port, command_line

Sigma

title: VMware ESXi OpenSLP RCE Attempt
author: SecBoard
date: 2023/10/27
modified: 2023/10/27
logsource:
  product: linux
  service: auditd
detection:
  selection_network:
    event_type: 'network'
    dest_port: 427
    process_name: 'slpd'
  selection_process:
    event_type: 'process_creation'
    parent_process_name: 'slpd'
    Image|endswith:
      - '\sh'
      - '\bash'
      - '\powershell.exe'
      - '\cmd.exe'
  condition: selection_network and selection_process
level: critical

Elastic ES|QL

from network where destination.port == 427 and process.name == "slpd"
join from process where event.type == "start" and process.parent.name == "slpd" and process.executable in ("/bin/sh", "/bin/bash", "/usr/bin/powershell", "C:\Windows\System32\cmd.exe")
| select @timestamp, host.name, process.name, destination.ip, destination.port, process.command_line