CVE-2024-37079 - What can you do about it!

Beyond patching for VMware vCenter Server's DCERPC protocol, I HIGHLY recommend incorporating Sysmon and Sysmon For Linux into any security stack. And here's why. From a Sysmon telemetry perspective, detecting exploitation attempts and post-compromise activity related to CVE-2024-37079 requires monitoring several key event types that reveal both the initial attack vector and subsequent adversary behavior. Event ID 1 (Process Creation) becomes the cornerstone for identifying post-exploitation activity, particularly when monitoring for unusual child processes spawned from vCenter-related parent processes such as vpxd.exe, vws.exe, or other VMware services running on the compromised system. Attackers who successfully exploit the DCERPC heap overflow to achieve remote code execution will inevitably spawn command interpreters like cmd.exe, powershell.exe, or pwsh.exe to establish their foothold and begin reconnaissance operations. Detection logic should zero in on process creation events where vCenter service binaries act as the parent process while executing unexpected utilities—think net.exe for user enumeration, wmic.exe for system reconnaissance, or encoded PowerShell commands that scream fileless malware deployment. Watch closely for the creation of reverse shells through processes like nc.exe, ncat.exe, or PowerShell remoting cmdlets spawned directly from VMware processes, as these represent clear indicators of successful exploitation. Persistence mechanisms deployed through schtasks.exe for scheduled tasks or sc.exe for service installations originating from vCenter processes should trigger immediate investigation since legitimate administrative operations follow entirely different execution patterns. Also consider that most Red Teams these days favor SSH as their C2 vehicle rather than popular frameworks which are heavily signatured like CobaltStrike.
Event ID 3 (Network Connection) provides the telemetry needed to identify both the initial exploitation vector and the command-and-control infrastructure attackers establish after gaining access. Since CVE-2024-37079 exploitation occurs through specially crafted DCERPC packets targeting TCP port 135, network connection monitoring should focus on identifying unusual source IPs, abnormal connection frequencies, or timing patterns that deviate from legitimate vCenter operations. The real value emerges in post-exploitation detection when monitoring outbound connections initiated by vCenter processes to external IP addresses—particularly connections to non-standard ports that could indicate reverse shells, data exfiltration channels, or C2 beacons contacting attacker infrastructure. Suspicious network patterns include vCenter services establishing connections to cloud storage providers, public file-sharing services, or known malicious IP ranges that never appear in normal virtualization management workflows. Legitimate vCenter operations follow predictable network communication patterns with ESXi hosts, vSphere clients, and internal management systems, so any deviation from this baseline—connections to residential IP ranges, Tor exit nodes, dynamic DNS providers, or geographic regions completely outside normal business operations—demands immediate investigation and response.
Beyond these primary event types, several additional Sysmon events provide critical visibility into attacker techniques and objectives after exploitation. Event ID 7 (Image Loaded) becomes invaluable for detecting malicious DLL injection or reflective loading techniques that sophisticated attackers employ to maintain stealth and execute code in memory without touching disk. Monitor aggressively for unusual DLLs loaded into vCenter processes or the loading of unsigned and suspicious libraries that have no legitimate business running in the VMware service context. Event ID 8 (CreateRemoteThread) helps identify thread injection techniques commonly used for credential theft or as a launching point for lateral movement from the compromised vCenter server into the broader virtual infrastructure. Event ID 10 (ProcessAccess) becomes particularly critical for detecting credential harvesting attempts since attackers with code execution will almost certainly target lsass.exe to dump credentials that enable lateral movement across the entire virtualized environment—giving them keys to every virtual machine under vCenter's management. Event ID 11 (FileCreate) should focus on webshells being dropped in VMware web directories, especially paths like C:\ProgramData\VMware\vCenterServer\data\perfcharts\tc-instance\webapps\ or similar web-accessible locations where attackers establish persistent web-based access that survives reboots and provides a reliable backdoor. Event ID 13 (RegistryEvent) provides essential detection capabilities for persistence mechanisms deployed through registry modifications, including Run keys, service configurations, or COM hijacking attempts that ensure attacker tools execute automatically. Event ID 22 (DNSEvent) reveals post-compromise activity through DNS queries to suspicious domains—look for dynamic DNS providers, recently registered domains, typosquatting variations of legitimate services, or known malicious infrastructure used for C2 communications after successful exploitation. The combination of these telemetry sources creates a comprehensive detection framework that addresses both the immediate exploitation indicators and the full spectrum of post-compromise adversary activity targeting your virtualized infrastructure.
This boils down to creating better telemetry for your organization's Threat Hunters to be able to pinpoint compromise irrespective of the vulnerability or exploit in play. In my opinion, this is the better way to futureproof your defense posture to handle adversaries of all shapes and sizes.