ESXi Curl or Wget Activity

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects `curl` or `wget` from the ESXi shell. These tools download a file or contact a remote URL from the
11hypervisor. A successful transfer can place a package or script on the host, often under `/tmp`, where a later
12command can execute it against the datastore.
13"""
14false_positives = [
15    """
16    Administrators use `wget` to download a patch, VIB, or support script during maintenance. Confirm the URL and
17whether the same session continues into file execution or virtual machine shutdown.
18    """,
19]
20from = "now-9m"
21index = ["logs-vsphere.log-*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "ESXi Curl or Wget Activity"
25note = """## Triage and analysis
26
27### Investigating ESXi Curl or Wget Activity
28
29curl and wget download a file or check a URL from the ESXi shell. The shell log records the command even when the binary is missing or the host has no route to the destination.
30
31#### Possible investigation steps
32
33- Read the URL and output path in message.
34- Check the same session for a file under /tmp, chmod, or execution of the downloaded file.
35- Confirm the URL with the virtualization owner.
36
37### False positive analysis
38
39A documented download of a vendor package is commonly benign. A download of an unknown file into /tmp, followed by chmod, deserves review.
40
41### Response and remediation
42
43- If the download was not approved, remove the file and end the shell session.
44- Preserve shell.log and review commands issued after the download.
45"""
46references = [
47    "https://lolesxi-project.github.io/LOLESXi/#",
48    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
49    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
50]
51setup = """## Setup
52
53This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
54"""
55risk_score = 47
56rule_id = "8b01751e-702d-5a27-b754-e2c6e020167f"
57severity = "medium"
58tags = [
59    "Domain: Endpoint",
60    "Data Source: VMware vSphere",
61    "Use Case: Threat Detection",
62    "Tactic: Command and Control",
63    "Resources: Investigation Guide",
64    "Rule Type: Custom Query (KQL)",
65    "Platform: VMware ESXi",
66    "Threat: Ransomware",
67]
68timestamp_override = "event.ingested"
69type = "query"
70
71query = '''
72data_stream.dataset: "vsphere.log" and event.module: "vsphere" and message: ("curl" or "wget")
73'''
74
75[[rule.threat]]
76framework = "MITRE ATT&CK"
77[[rule.threat.technique]]
78id = "T1105"
79name = "Ingress Tool Transfer"
80reference = "https://attack.mitre.org/techniques/T1105/"
81
82[rule.threat.tactic]
83id = "TA0011"
84name = "Command and Control"
85reference = "https://attack.mitre.org/tactics/TA0011/"
86
87[rule.investigation_fields]
88field_names = [
89    "@timestamp",
90    "message",
91    "event.original",
92    "host.hostname",
93    "log.file.path",
94]