CPE
Exploitation of CVE-2021-21985 in VMware vCenter Server
1 rule 1 TTP 1 CVEPublic proof-of-concept exploits for CVE-2021-21985 have been released, enabling unauthenticated remote code execution in VMware vCenter Server via the Virtual SAN Health Check plug-in.
VMware vCenter Server Backup API Flag Injection Vulnerability (CVE-2024-22274)
2 TTPs 1 CVEA newly released PoC exploit for CVE-2024-22274 enables authenticated attackers to perform flag injection within VMware vCenter Server backup API components, resulting in remote code execution as root.
Potential CVE-2025-41244 vmtoolsd Local Privilege Escalation Attempt
1 rule 3 TTPs 1 CVEAttackers can exploit CVE-2025-41244, a local privilege escalation vulnerability in VMware Tools' `vmtoolsd` service and its `get-versions.sh` script on Linux, by manipulating the `PATH` environment variable to execute malicious binaries with elevated privileges when the service attempts to retrieve version information, potentially leading to a root shell.
Detection of Windows Privileged Group Modifications
2 rules 2 TTPs 1 CVEThis brief covers the detection of modifications to privileged Active Directory groups, potentially linked to the exploitation of CVE-2024-37085, where attackers may attempt to manipulate privileged groups to gain unauthorized access to systems.