CVE-2021-21985

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "java.exe" or InitiatingProcessFileName =~ "python.exe" or InitiatingProcessFileName =~ "powershell.exe" // Oder andere relevante Prozesse für vCenter
| where FileName in ("cmd.exe", "powershell.exe", "sh", "bash") // Ungewöhnliche Shell-Ausführungen
| where FolderPath contains "vCenter" or InitiatingProcessCommandLine contains "vCenter"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, RemoteIP, RemotePort

Splunk SPL

index=your_vcenter_logs (source="*vcenter*" OR host="*vcenter*") (process_name="java" OR process_name="python" OR process_name="powershell") (command="cmd.exe" OR command="powershell.exe" OR command="sh" OR command="bash") | table _time, host, process_name, command, user, dest_ip, dest_port

Sigma

title: VCenter RCE via VSAN Health Check Plugin
status: experimental
description: Detects potential remote code execution attempts on VMware vCenter Server via the Virtual SAN Health Check plug-in (CVE-2021-21985).
references:
    - https://www.vmware.com/security/advisories/VMSA-2021-0010.html
logsource:
    category: process_creation
    product: windows
    service: security
detection:
    selection:
        ParentImage|endswith:
            - '\java.exe'
            - '\python.exe'
            - '\powershell.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\sh'
            - '\bash'
    condition: selection
fields:
    - Image
    - ParentImage
    - CommandLine
level: critical

Elastic ES|QL

from process where process.parent.executable in ("java.exe", "python.exe", "powershell.exe") and process.executable in ("cmd.exe", "powershell.exe", "sh", "bash") and process.args like "*vCenter*"