[[ fm.text ]] Click here

vCenter Syslog or Reverse SSH Post-Exploitation Process - STRICT

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown

Alerts on either a syslog service spawning a shell, transfer utility, or interpreter with suspicious download, temporary-path, execution, or tunnel arguments, or a root process establishing reverse SSH tooling or persistence from a suspicious context. These patterns are consistent with CVE-2026-59310 post-exploitation and indicate probable unauthorized execution or persistent access, but approved syslog hooks or support tunnels can match. SOC L1 should verify the root identity, parent process, full command line, and executable path, then correlate with external SSH connections, new services or scheduled tasks, and recent vCenter exploitation indicators. Déclenche une alerte lorsqu’un service syslog lance un shell, un outil de transfert ou un interpréteur avec des arguments suspects de téléchargement, de chemin temporaire, d’exécution ou de tunnel, ou lorsqu’un processus root établit un outil de reverse SSH ou une persistance depuis un contexte suspect. Ces schémas sont compatibles avec une post-exploitation de la CVE-2026-59310 et indiquent une exécution non autorisée ou un accès persistant probables, mais des traitements syslog ou des tunnels de support approuvés peuvent correspondre. Le SOC L1 doit vérifier l’identité root, le processus parent, la ligne de commande complète et le chemin de l’exécutable, puis corréler avec les connexions SSH externes, les nouveaux services ou tâches planifiées et les indicateurs récents d’exploitation de vCenter.

title: vCenter Syslog or Reverse SSH Post-Exploitation Process - STRICT
id: 7be42169-9385-4c2a-8d1c-6b75f70120d4
status: experimental
description: |
  Alerts on either a syslog service spawning a shell, transfer utility, or interpreter with suspicious download, temporary-path, execution, or tunnel arguments, or a root process establishing reverse SSH tooling or persistence from a suspicious context. These patterns are consistent with CVE-2026-59310 post-exploitation and indicate probable unauthorized execution or persistent access, but approved syslog hooks or support tunnels can match. SOC L1 should verify the root identity, parent process, full command line, and executable path, then correlate with external SSH connections, new services or scheduled tasks, and recent vCenter exploitation indicators.
  Déclenche une alerte lorsqu’un service syslog lance un shell, un outil de transfert ou un interpréteur avec des arguments suspects de téléchargement, de chemin temporaire, d’exécution ou de tunnel, ou lorsqu’un processus root établit un outil de reverse SSH ou une persistance depuis un contexte suspect. Ces schémas sont compatibles avec une post-exploitation de la CVE-2026-59310 et indiquent une exécution non autorisée ou un accès persistant probables, mais des traitements syslog ou des tunnels de support approuvés peuvent correspondre. Le SOC L1 doit vérifier l’identité root, le processus parent, la ligne de commande complète et le chemin de l’exécutable, puis corréler avec les connexions SSH externes, les nouveaux services ou tâches planifiées et les indicateurs récents d’exploitation de vCenter.
references:
  - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017
  - https://nvd.nist.gov/vuln/detail/CVE-2026-59310
  - https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/
  - https://github.com/QUIRSO/QTRDetectionContent/blob/main/2026-08-10_reverse_ssh_generic.yar
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-08-19
related:
  - id: 2b160462-b4c8-4b19-b5fd-8f4f69af2e8d
    type: derived
logsource:
  product: linux
  category: process_creation
detection:
  selection_syslog_parent_image:
    ParentImage|endswith:
      - /rsyslogd
      - /syslog-ng
      - /vmsyslogd
      - /vmware-syslog
  selection_syslog_parent_name:
    ParentProcessName|endswith:
      - rsyslogd
      - syslog-ng
      - vmsyslogd
      - vmware-syslog
  selection_syslog_parent_cli:
    ParentCommandLine|contains:
      - rsyslogd
      - syslog-ng
      - vmsyslogd
      - vmware-syslog
  selection_syslog_child:
    Image|endswith:
      - /sh
      - /bash
      - /dash
      - /busybox
      - /python
      - /python3
      - /perl
      - /ruby
      - /node
      - /curl
      - /wget
      - /scp
      - /sftp
      - /nc
      - /ncat
      - /socat
      - /reverse_ssh
  selection_syslog_cli:
    CommandLine|contains:
      - http://
      - https://
      - /tmp/
      - /var/tmp/
      - /dev/shm/
      - reverse_ssh
      - 'chmod +x'
      - '| sh'
      - '| bash'
      - 'base64 -d'
      - ' -e /bin/'
      - ' -R '
  selection_root_user:
    User: root
  selection_root_uid:
    UserId: 0
  selection_root_effective_uid:
    EffectiveUserId: 0
  selection_reverse_tool_name:
    Image|endswith:
      - /reverse_ssh
      - /reverse-ssh
      - /reverse-sshx64
  selection_reverse_tool_cli:
    CommandLine|contains:
      - reverse_ssh
      - reverse-ssh
  selection_suspicious_path:
    Image|startswith:
      - /tmp/
      - /var/tmp/
      - /dev/shm/
      - /run/user/
  selection_exploit_parent:
    ParentImage|endswith:
      - /rsyslogd
      - /syslog-ng
      - /vmsyslogd
      - /vmware-syslog
  selection_ssh_binary:
    Image|endswith:
      - /ssh
      - /autossh
      - /dropbear
  selection_reverse_tunnel:
    CommandLine|contains:
      - ' -R '
      - ' -L 0.0.0.0:'
      - ExitOnForwardFailure=yes
  selection_persistence:
    CommandLine|contains:
      - /etc/systemd/system/
      - /etc/cron.d/
      - 'crontab '
      - '@reboot'
      - 'systemctl enable'
  condition: (1 of selection_syslog_parent_* and selection_syslog_child and selection_syslog_cli) or (1 of selection_root_* and (((selection_reverse_tool_name or selection_reverse_tool_cli) and (selection_suspicious_path or selection_exploit_parent)) or (selection_ssh_binary and selection_reverse_tunnel and selection_persistence)))
fields:
  - UtcTime
  - Computer
  - User
  - UserId
  - EffectiveUserId
  - Image
  - CommandLine
  - ParentImage
  - ParentProcessName
  - ParentCommandLine
  - CurrentDirectory
  - ProcessId
  - ParentProcessId
falsepositives:
  - An explicitly approved syslog processing hook with a documented transfer operation
  - Authorized incident-response tooling or a time-bounded VMware support reverse tunnel
level: critical
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
  - attack.persistence
  - attack.command-and-control
  - attack.t1090
  - attack.t1105
  - attack.t1543.002
  - cve.2026-59310

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1d3cbf12-de86-4779-87d3-07a512b61218

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion