vmware-aria-operations.yaml

info:
  id: vmware-aria-operations
  name: VMware Aria Operations Detected
  author: OpenAI
  description: Template to detect the VMware Aria Operations service
  severity: Medium
  classification:
    country: any
    tags:
      - vmware
      - aria-operations
      - security

  reference:
    - https://www.vmware.com/security/advisories/VMSA-2023-0007.html

  matcher-condition: and

  requests:
      method: GET
      path:
        - "/"
      headers:
        - name: User-Agent
          value: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3
      description: Attempt to retrieve VMware Aria Operations web page
      condition: or

  matchers:
    - pattern: "VMware Aria Operations</title>"
    - pattern: "Operations for Logs - Login | </title>"
      type: body
      description: VMware Aria Operations page title found in response body
    - pattern: "window.AriaConfig = {"
      type: body
      description: VMware Aria Operations configuration found in response body

  response:
    - status:
        - 200
      description: Successful response status