CVE-2021-21972

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "vpxd.exe" or InitiatingProcessFileName =~ "java.exe" // Oder andere relevante vCenter-Prozesse
| where FileName in ("cmd.exe", "powershell.exe", "bash", "sh") or ProcessCommandLine contains "upload" or ProcessCommandLine contains "wget" or ProcessCommandLine contains "curl"
| summarize count() by DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine

Splunk SPL

index=your_vcenter_index (sourcetype=your_process_logs OR sourcetype=your_file_upload_logs) (parent_process="vpxd.exe" OR parent_process="java.exe") (process="cmd.exe" OR process="powershell.exe" OR process="bash" OR process="sh" OR command_line=*upload* OR command_line=*wget* OR command_line=*curl*)
| stats count by host, parent_process, process, command_line

Sigma

title: VMware vCenter RCE via vSphere Client Plugin
status: experimental
description: Detects potential remote code execution attempts against VMware vCenter Server via the vSphere Client plugin (CVE-2021-21972).
references:
  - https://www.vmware.com/security/advisories/VMSA-2021-0002.html
logsource:
  category: process_creation
  product: windows
  service: security
detection:
  selection:
    ParentImage|endswith:
      - '\vpxd.exe'
      - '\java.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\bash'
      - '\sh'
  condition: selection
falsepositives:
  - Legitimate administrative activities (requires tuning)
level: critical

Elastic ES|QL

FROM process WHERE (process.parent.name == "vpxd.exe" OR process.parent.name == "java.exe") AND (process.name == "cmd.exe" OR process.name == "powershell.exe" OR process.name == "bash" OR process.name == "sh" OR process.args LIKE "*upload*" OR process.args LIKE "*wget*" OR process.args LIKE "*curl*")