Connection from external IP to OMI related Ports

This query detects attempts to exploit OMI vulnerability (CVE-2021-38647) by identifying external IP connections to management ports (5985,5986,1270). It uses the imNetworkSession schema and other logs for this purpose.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Linux macOS Network Devices PRE Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source product: azurefirewall azuremonitor_vminsights azurenetworkwatcher
Log source service: azurediagnostics azurenetworkanalytics_cl vmconnection

Detection rules

Connection from external IP to OMI related Ports

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules