VMware vCenter Server CVE-2021-22005 File Upload Exploit

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•43

Detects exploitation attempts targeting the VMware vCenter Server using the file upload vulnerability CVE-2021-22005. The rule specifically looks for POST requests to the '/analytics/telemetry/ph/api/hyper/send?' URI, which is indicative of an attempt to leverage this vulnerability for file upload.