Technical Tip: How to use FortiAnalyzer to detect activities related to the VMware vCenter Remote Code Execution vulnerability

[keithli_FTNT]

Description

This article describes how to use a custom Event Handler and Report in FortiAnalyzer to detect activities related to the VMware vCenter Remote Code Execution vulnerability. See CVE-2021-21985 and CVE-2021-21986 for reference.

For more information on the threat, also see the FortiGuard Lab Threat Signal Report:

Reports of Active in the Wild Exploitation of VMware vCenter Remote Code Execution Vulnerability (CV...

What is included in Fortinet_SOC-VMware-vCenter-Detection.zip?

1) outbreak_alerts_service_VMware.vCenter_detection.json

This event handler helps identify indicators detected by FortiGate's and FortiClient's IPS and Endpoint Vulnerability signatures. Logs triggering the event handler are generated from FortiGate and FortiClient. Therefore, their corresponding IPS and Endpoint Vulnerability signatures should be kept up to date to prevent and log the exploits.

FortiGate: Ensure IPS Signature package is at least 18.112 or higher in order to cover VMware.vCenter.CVE-2021-21985.Remote.Code.Execution

FortiClient: Ensure Endpoint Vulnerability Protection is at least 1.246 or higher to cover VMware vCenter Server updates address remote code execution and authentication vulnerabilities (CVE-...

2) outbreak_alerts_service_VMware.vCenter_report.dat

A report to summarize findings on activities related to the VMware vCenter Remote Code Execution vulnerability, as detected by the IPS Engine and Ednpoint Vulnerability on FortiGate and FortiClient devices.

See the Solution section for instruction on how to load the event handler into a FortiAnalyzer unit.

Scope
The custom Event Handler and Report provided can be used in FortiAnalyzer 6.4+
Solution

All screen shots provided below for illustration purposes are taken from FortiAnalyzer 7.0.0.

1) Download the Fortinet_SOC-VMware-vCenter-Detection.zip file (contains 2 files)

2) Unzip Fortinet_SOC-VMware-vCenter-Detection.zip

3) Use outbreak_alerts_service_VMware.vCenter_detection.json to import into Event Handlers

    a. Choose an ADOM (if ADOMs are enabled)

    b. Choose the FortiSOC module

    c. Select Event Handler List

    d. Select the Import option under "More"

    e. Select outbreak_alerts_service_VMware.vCenter_detection.json

Result:outbreak_alerts_service_VMware.vCenter_detection.json is enabled and will be triggered if the appropriate logs are received after after the event handler was imported

4) Use outbreak_alerts_service_VMware.vCenter_report.dat to import into Reports

    a. Choose a Fabric ADOM (if ADOMs are enabled)

    b. Choose the Report module

    c. Select the Import option under "More"

    d. Select outbreak_alerts_service_VMware.vCenter_report.dat

Result: 'outbreak_alerts_service_VMware.vCenter_report.dat' can be run anytime as determined by an admin user.