Potential CVE-2022-31659 RCE Activity via POST to Workspace ONE Access Tenant Migration API

Alerts on POST requests to the Workspace ONE Access tenant migration API endpoint associated with CVE-2022-31659.

FreeUnreviewedSigmamediumv1

potential-cve-2022-31659-rce-activity-via-post-to-workspace-one-access-tenant-mi-efdb2003

title: Potential CVE-2022-31659 RCE Activity via POST to Workspace ONE Access Tenant Migration API
id: 8befade1-4b48-4e0e-bc3a-d78a661b0cdc
status: test
description: This rule flags webserver requests that use POST to a specific Workspace ONE Access Admin migration endpoint. Attackers may use this type of request to deliver payloads or trigger actions tied to CVE-2022-31659. The detection relies on HTTP request telemetry, specifically the HTTP method and the presence of the targeted URI path fragment in the URL query field.
references:
  - https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-31659/web_cve_2022_31659_vmware_rce.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-12
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2022-31659
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains: /SAAS/jersey/manager/api/migrate/tenant
  condition: selection
falsepositives:
  - Vulnerability scanners
  - Legitimate access to the URI
level: medium
license: DRL-1.1
related:
  - id: efdb2003-a922-48aa-8f37-8b80021a9706
    type: derived

What it detects

This rule flags webserver requests that use POST to a specific Workspace ONE Access Admin migration endpoint. Attackers may use this type of request to deliver payloads or trigger actions tied to CVE-2022-31659. The detection relies on HTTP request telemetry, specifically the HTTP method and the presence of the targeted URI path fragment in the URL query field.

Known false positives

Vulnerability scanners
Legitimate access to the URI

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.