CVE2024

CVE-2024-37085

2Rules

1References

1Folders

2024-07-30Latest

Summary

CVE-2024-37085 is tracked here through 2 Sigma detections for exploitation attempts and related post-exploitation behavior observed in 2024. Coverage centers on windows / process_creation, windows / security.

Related Detections

Search this threat

hightestEmerging Threat

Potential Exploitation of CVE-2024-37085 - Suspicious ESX Admins Group Activity

Detects any creation or modification to a windows domain group with the name "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

windowssecurity

2024-07-30

hightestEmerging Threat

Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group

Detects execution of the "net.exe" command in order to add a group named "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

windowsprocess_creation

2024-07-29

References

Resolving title…

microsoft.com