VMWare Aria Operations Exploit Attempt

name: VMWare Aria Operations Exploit Attempt
id: d5d865e4-03e6-43da-98f4-28a4f42d4df7
version: 10
creation_date: '2023-06-21'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: |
    The following analytic detects potential exploitation attempts against VMWare vRealize Network Insight, specifically targeting the CVE-2023-20887 vulnerability.
    It monitors web traffic for HTTP POST requests directed at the vulnerable endpoint "/saas./resttosaasservlet." This detection leverages web traffic data, focusing on specific URL patterns and HTTP methods.
    Identifying this behavior is crucial for a SOC as it indicates an active exploit attempt.
    If confirmed malicious, the attacker could execute arbitrary code, leading to unauthorized access, data theft, or further network compromise.
data_source:
    - Palo Alto Network Threat
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime
    
    FROM datamodel=Web WHERE
    
    Web.url="*/saas./resttosaasservlet*"
    Web.http_method=POST
    Web.status IN (
        "unknown",
        "200"
    )
    BY Web.http_user_agent Web.status
       Web.http_method Web.url Web.url_length
       Web.src Web.dest
    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `vmware_aria_operations_exploit_attempt_filter`
how_to_implement: |
    To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. Restrict to specific dest assets to reduce false positives.
known_false_positives: |
    False positives will be present based on gateways in use, modify the status field as needed.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-20887
    - https://viz.greynoise.io/tag/vmware-aria-operations-for-networks-rce-attempt?days=30
    - https://github.com/sinsinology/CVE-2023-20887
    - https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/
finding:
    title: An exploitation attempt has occurred against $dest$ from $src$ related to CVE-2023-20887
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - VMware Aria Operations vRealize CVE-2023-20887
asset_type: Web Server
cve:
    - CVE-2023-20887
mitre_attack_id:
    - T1133
    - T1190
    - T1210
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network