Coverage › CVE-2023-34048

CVE-2023-34048 Mapped Sigma

VMware vCenter Server Out-of-Bounds Write Vulnerability

Vendor / product

VMware — vCenter Server

Description (CISA)

VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.

Added to KEV

2024-01-22

Due date

2024-02-12

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Known ransomware use

Unknown

CWE

CWE-787

CISA notes

https://www.vmware.com/security/advisories/VMSA-2023-0023.html
https://nvd.nist.gov/vuln/detail/CVE-2023-34048

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1203 Exploitation for Client Execution primary impact

• DET0287 Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps)
  AN0797 Windows

  Cause→effect chain: (1) A client app (browser, Office, PDF/Flash/reader) experiences a crash/abnormal exit or loads from an unusual location, then (2) drops or modifies a file in user-writable paths, and/or (3) spawns an unexpected child (e.g., powershell/cmd/mshta/rundll32/wscript/installer), and (4) establishes outbound C2-like connections shortly after. Correlate application logs, file writes, process lineage, and network egress within a short window.

  WinEventLog:Application EventCode=1000 → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: TimeWindow HighRiskChildren UserPaths AllowedPlugins EgressAllowlist
  AN0798 Linux

  Cause→effect chain: (1) Browser/Office/reader process logs crash/segfault or abnormal sandbox message, (2) new executable/script/write occurs in $HOME (Downloads, ~/.cache, /tmp), (3) unexpected child like curl/wget/bash/python opens network connections soon after.

  linux:syslog browser/office crash, segfault, abnormal termination → DC0038 Application Log Content

  auditd:SYSCALL open → DC0055 File Access

  auditd:SYSCALL creat → DC0039 File Creation

  auditd:SYSCALL rename,chmod → DC0061 File Modification

  auditd:SYSCALL execve → DC0032 Process Creation

  NetFlow:Flow new outbound connections from exploited process tree → DC0078 Network Traffic Flow

  Tunable: TimeWindow UserPaths HighRiskChildren PackageUpdaters
  AN0799 macOS

  Cause→effect chain: (1) App crash/abnormal termination in unified logs for Safari/Chrome/Office/Preview, (2) new files/scripts in ~/Library, ~/Downloads, /private/var/folders/*, (3) unexpected child (osascript, zsh, bash, curl) spawned by those apps, (4) new outbound connections.

  macos:unifiedlog process crash, abort, code signing violations → DC0038 Application Log Content

  fs:fsevents create/write/rename under user-writable paths → DC0061 File Modification

  macos:osquery exec → DC0032 Process Creation

  NSM:Connections new connections from exploited lineage → DC0078 Network Traffic Flow

  Tunable: TimeWindow HighRiskChildren UserPaths QuarantineBypass

Sigma rules tagged attack.t1203 (35)

All 35 rules on the technique page →

T1588.001 Malware secondary impact

• DET0845 Detection of Malware
  AN1977 PRE

  Monitor for contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle. Consider analyzing malware for features that may be associated with malware providers, such as compiler used, debugging artifacts, code similarities, or even group identifiers associated with specific MaaS offerings. Malware repositories can also be used to identify additional samples associated with the developers and the adversary utilizing their services. Identifying overlaps in malware use by different adversaries may indicate malware was obtained by the adversary rather than developed by them. In some cases, identifying overlapping characteristics in malware used by different adversaries may point to a shared quartermaster.

  Malware Repository None → DC0003 Malware Metadata

  Malware Repository None → DC0011 Malware Content

Sigma rules tagged attack.t1588.001 (1)