ESXi Shell Command Obfuscation

  1[metadata]
  2creation_date = "2026/09/30"
  3integration = ["vsphere"]
  4maturity = "production"
  5updated_date = "2026/09/30"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects ESXi shell commands that rebuild a command with encoding instead of writing it in clear text, including
 11octal and hex `printf`, Python `chr()`, `awk` `%c` sequences, reversed strings, and invisible Unicode. The shell
 12log then hides the administrative command. The decoded action can still change syslog, the firewall, or other
 13host settings.
 14"""
 15false_positives = [
 16    """
 17    Rare troubleshooting one-liners can use `printf` or `awk` to generate text. A line that
 18also decodes to a syslog, firewall, or VM command should still be investigated.
 19    """,
 20]
 21from = "now-9m"
 22index = ["logs-vsphere.log-*"]
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "ESXi Shell Command Obfuscation"
 26note = """## Triage and analysis
 27
 28### Investigating ESXi Shell Command Obfuscation
 29
 30ESXi shell.log stores the command text. Encoding the letters of esxcli is an attempt to keep a destructive command out of simple string searches. The decoded action is often a syslog reset or a VM listing.
 31
 32#### Possible investigation steps
 33
 34- Copy message and decode it. Octal 145 163 170, hex 65 73 78, chr(101), and repeated percent-c sequences all spell esx.
 35- If the decoded command resets syslog, changes the firewall, or kills a VM, follow that detection as well.
 36- Compare the account and source with normal ESXi administration. Operators rarely need these encodings.
 37
 38### False positive analysis
 39
 40A lab or training host may replay published obfuscation samples. On a production host, treat the encoded command as hostile until the decoded text is explained.
 41
 42### Response and remediation
 43
 44- Decode and record the command, then check esxcli system syslog config get and the firewall state in case the payload already ran.
 45- End the shell session and disable SSH if it was not required.
 46- Preserve shell.log before rotation. The encoded line is the evidence.
 47"""
 48references = [
 49    "https://lolesxi-project.github.io/LOLESXi/#",
 50    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
 51    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
 52]
 53setup = """## Setup
 54
 55This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
 56"""
 57risk_score = 73
 58rule_id = "a7716b79-b964-58ea-8773-333eb42a8d78"
 59severity = "high"
 60tags = [
 61    "Domain: Endpoint",
 62    "Data Source: VMware vSphere",
 63    "Use Case: Threat Detection",
 64    "Tactic: Defense Evasion",
 65    "Tactic: Execution",
 66    "Resources: Investigation Guide",
 67    "Rule Type: Custom Query (KQL)",
 68    "Platform: VMware ESXi",
 69    "Threat: Encoding-Based Obfuscation",
 70]
 71timestamp_override = "event.ingested"
 72type = "query"
 73
 74query = '''
 75data_stream.dataset: "vsphere.log" and (
 76  message: (
 77    "chr(101)" or
 78    "%c%c%c%c%c%c" or
 79    "ilcxse" or
 80    "0xe2,0x80,0x8b" or
 81    "0xf3,0xb0,0x80,0x80" or
 82    "\\x65\\x73\\x78" or
 83    "\\145\\163\\170"
 84  )
 85)
 86'''
 87
 88[[rule.threat]]
 89framework = "MITRE ATT&CK"
 90[[rule.threat.technique]]
 91id = "T1027"
 92name = "Obfuscated Files or Information"
 93reference = "https://attack.mitre.org/techniques/T1027/"
 94
 95[rule.threat.tactic]
 96id = "TA0005"
 97name = "Defense Evasion"
 98reference = "https://attack.mitre.org/tactics/TA0005/"
 99
100[[rule.threat]]
101framework = "MITRE ATT&CK"
102[[rule.threat.technique]]
103id = "T1059"
104name = "Command and Scripting Interpreter"
105reference = "https://attack.mitre.org/techniques/T1059/"
106[[rule.threat.technique.subtechnique]]
107id = "T1059.004"
108name = "Unix Shell"
109reference = "https://attack.mitre.org/techniques/T1059/004/"
110
111[rule.threat.tactic]
112id = "TA0002"
113name = "Execution"
114reference = "https://attack.mitre.org/tactics/TA0002/"
115
116[rule.investigation_fields]
117field_names = [
118    "@timestamp",
119    "message",
120    "event.original",
121    "host.hostname",
122    "log.file.path",
123]