Rule History

alert tcp any any -> $HOME_NET 427 (msg:"ET EXPLOIT VMWare ESXi 6.7.0 OpenSLP Remote Code Execution Attempt - Directory Agent Advertisement Heap Overflow (CVE-2021-21974)"; flow:established,to_server; dsize:>280; content:"|02 08|"; startswith; byte_jump:2,19,relative,little; byte_test:2,>=,256,0,relative; content:"|01|:/"; reference:url,straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9; reference:cve,2021-21974; classtype:attempted-admin; sid:2044114; rev:1; metadata:affected_product VMware, attack_target Server, created_at 2023_02_03, cve CVE_2021_21974, deployment Perimeter, deployment Internal, deployment Datacenter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_02_03, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)