CVE-2021-21975

Sentinel/Defender KQL

VMwarevRealizeOperationsLogs
| where Message contains "API" and Message contains "SSRF" or Message contains "Server Side Request Forgery"
| where Message contains "steal administrative credentials" or Message contains "unusual external request" or Message contains "internal service access"
| project TimeGenerated, Hostname, Message, SourceIP, UserName
| extend EventType = "CVE-2021-21975_SSRF_Attempt"

Splunk SPL

index=vmware_vrealize_operations (API AND ("SSRF" OR "Server Side Request Forgery")) (("steal administrative credentials" OR "unusual external request" OR "internal service access"))
| table _time, host, sourcetype, message, src_ip, user
| eval EventType = "CVE-2021-21975_SSRF_Attempt"

Sigma

title: VMware vRealize Operations SSRF Attempt
logsource:
  product: vmware
  service: vrealize_operations
detection:
  keywords:
    - 'API'
    - 'SSRF'
    - 'Server Side Request Forgery'
    - 'steal administrative credentials'
    - 'unusual external request'
    - 'internal service access'
  condition: keywords
level: high

Elastic ES|QL

FROM vmware_vrealize_operations_logs
WHERE message LIKE '%API%' AND (message LIKE '%SSRF%' OR message LIKE '%Server Side Request Forgery%') AND (message LIKE '%steal administrative credentials%' OR message LIKE '%unusual external request%' OR message LIKE '%internal service access%')
SELECT @timestamp, host.name, message, source.ip, user.name
EXPAND EventType = 'CVE-2021-21975_SSRF_Attempt'