VMWare-LPE-2022-22960

Hunt Hypothesis

The query checks process command being placed into the script; CVE-2022-22960 allows a user to write to it and be executed as root. This vulnerability of VMware Workspace ONE Access, Identity Manager

KQL Query

DeviceProcessEvents
| where InitiatingProcessCommandLine has_any ("/opt/vmware/certproxy/bing/certproxyService.sh", "/horizon/scripts/exportCustomGroupUsers.sh", "/horizon/scripts/extractUserIdFromDatabase.sh")
    or FileName has_any ("certproxyService.sh", "exportCustomGroupUsers.sh", "extractUserIdFromDatabase.sh ")
| project Timestamp, DeviceName , FileName, ProcessCommandLine, InitiatingProcessCommandLine 

Analytic Rule Definition

id: 1d468d49-ffea-4daf-ba6b-72525ec17b61
name: VMWare-LPE-2022-22960
description: |
  The query checks process command being placed into the script; CVE-2022-22960 allows a user to write to it and be executed as root.
  This vulnerability of VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.
  CVE: CVE-2022-22960.
  Read more here:.
  https://www.cisa.gov/uscert/ncas/alerts/aa22-138b
  https://www.vmware.com/security/advisories/VMSA-2022-0011.html
  Tags: #exploit #CVE-2022-22960
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
  - Execution
  - Privilege Escalation
relevantTechniques:
  - T1204
  - T1548
query: |
  DeviceProcessEvents
  | where InitiatingProcessCommandLine has_any ("/opt/vmware/certproxy/bing/certproxyService.sh", "/horizon/scripts/exportCustomGroupUsers.sh", "/horizon/scripts/extractUserIdFromDatabase.sh")
      or FileName has_any ("certproxyService.sh", "exportCustomGroupUsers.sh", "extractUserIdFromDatabase.sh ")
  | project Timestamp, DeviceName , FileName, ProcessCommandLine, InitiatingProcessCommandLine 

Required Data Sources

False Positive Guidance

• Scenario: Certificate Renewal Script Execution
  Description: An administrator runs the `cert

MITRE ATT&CK Context

• Tactic: Execution
• Tactic: Privilege Escalation
• Technique: T1204 — T1204
• Technique: T1548 — T1548

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Exploits/VMWare-LPE-2022-22960.yaml)