OMI Vulnerability Exploitation

Severity: medium
Time window: 1d
Group by: Computer
Author: Ron Marsiano
Source: github.com/Azure/Azure-Sentinel

Following the September 14th, 2021 release of three Elevation of Privilege (EoP) vulnerabilities (CVE-2021-38645, CVE-2021-38649, CVE-2021-38648) and one unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2021-38647) in the Open Management Infrastructure (OMI) Framework. This detection validates that any OMS-agent that is reporting to the Microsoft Sentinel workspace is updated with the patch. The detection will go over the heartbeats received from all agents over the last day and will create alert for those agents who are not updated.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule body

id: 3cc5ccd8-b416-4141-bb2d-4eba370e37a5
name: OMI Vulnerability Exploitation
description: |
  Following the September 14th, 2021 release of three Elevation of Privilege (EoP) vulnerabilities (CVE-2021-38645, CVE-2021-38649, CVE-2021-38648) and one unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2021-38647) in the Open Management Infrastructure (OMI) Framework.
  This detection validates that any OMS-agent that is reporting to the Microsoft Sentinel workspace is updated with the patch. The detection will go over the heartbeats received from all agents over the last day and will create alert for those agents who are not updated.
requiredDataConnectors: []
severity: Medium
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
tags:
  - OMIGOD
  - CVE-2021-38647
query: |
  let OMIVulnerabilityPatchVersion = "OMIVulnerabilityPatchVersion:1.13.40-0";
  Heartbeat
  | where Category == "Direct Agent"
  | summarize arg_max(TimeGenerated,*) by Computer
  | parse strcat("Version:" , Version) with * "Version:" Major:long "."
  Minor:long "." Patch:long "-" *
  | parse OMIVulnerabilityPatchVersion with * "OMIVulnerabilityPatchVersion:"
  OMIVersionMajor:long "." OMIVersionMinor:long "." OMIVersionPatch:long "-" *
  | where Major <OMIVersionMajor or (Major==OMIVersionMajor and Minor
  <OMIVersionMinor) or (Major==OMIVersionMajor and Minor==OMIVersionMinor and
  Patch<OMIVersionPatch) 
  | project Version, Major,Minor,Patch,
  Computer,ComputerIP,OSType,OSName,ResourceId
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: Computer
  - entityType: AzureResource
    fieldMappings:
      - identifier: ResourceId
        columnName: ResourceId
customDetails:
  HostIp: ComputerIP
  OSType: OSType
  OSName: OSName
kind: Scheduled
version: 1.1.5
metadata:
    source:
        kind: Community
    author:
        name: Ron Marsiano
    support:
        tier: Community
    categories:
        domains: [ "Security - Vulnerability Management" ]

Stages and Predicates

Parameters

let OMIVulnerabilityPatchVersion = "OMIVulnerabilityPatchVersion:1.13.40-0";

Stage 1: `source`

Heartbeat

Stage 2: `where`

| where Category == "Direct Agent"

Stage 3: `summarize`

| summarize arg_max(TimeGenerated,*) by Computer

Stage 4: `parse`

| parse strcat("Version:" , Version) with * "Version:" Major:long "."
Minor:long "." Patch:long "-" *

Stage 5: `parse`

| parse OMIVulnerabilityPatchVersion with * "OMIVulnerabilityPatchVersion:"
OMIVersionMajor:long "." OMIVersionMinor:long "." OMIVersionPatch:long "-" *

Stage 6: `where`

| where Major <OMIVersionMajor or (Major==OMIVersionMajor and Minor
<OMIVersionMinor) or (Major==OMIVersionMajor and Minor==OMIVersionMinor and
Patch<OMIVersionPatch)

Stage 7: `project`

| project Version, Major,Minor,Patch,
Computer,ComputerIP,OSType,OSName,ResourceId

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Category`	eq	`Direct Agent`	`field:"Category" kind:eq value:"Direct Agent"`
`Major`	cross_field_compare	`OMIVersionMajor` transforms: `op:lt`	`field:"Major" kind:cross_field_compare value:"OMIVersionMajor"`
`Minor`	cross_field_compare	`OMIVersionMinor` transforms: `op:lt`	`field:"Minor" kind:cross_field_compare value:"OMIVersionMinor"`
`Patch`	cross_field_compare	`OMIVersionPatch` transforms: `op:lt`	`field:"Patch" kind:cross_field_compare value:"OMIVersionPatch"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Computer`	`project`
`ComputerIP`	`project`
`Major`	`project`
`Minor`	`project`
`OSName`	`project`
`OSType`	`project`
`Patch`	`project`
`ResourceId`	`project`
`Version`	`project`

OMI Vulnerability Exploitation

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: parse

Stage 5: parse

Stage 6: where

Stage 7: project