ESXi Payload Executed Against Datastore

  1[metadata]
  2creation_date = "2026/09/30"
  3integration = ["vsphere"]
  4maturity = "production"
  5updated_date = "2026/09/30"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects a program launched from the ESXi shell against `/vmfs/volumes`. The datastore holds the virtual disks of
 11every guest. A process pointed at that path can read or encrypt those disks and take the hosted virtual machines
 12offline.
 13"""
 14false_positives = [
 15    """
 16    A support script stored under `/tmp` or a Python inventory check can be pointed at a datastore during
 17maintenance. Confirm the file name, the account, and whether virtual machines were shut down in the same session.
 18    """,
 19]
 20from = "now-9m"
 21index = ["logs-vsphere.log-*"]
 22language = "kuery"
 23license = "Elastic License v2"
 24name = "ESXi Payload Executed Against Datastore"
 25note = """## Triage and analysis
 26
 27### Investigating ESXi Payload Executed Against Datastore
 28
 29This is the launch command. A path under /tmp, or python, is invoked with /vmfs/volumes as an argument. Ragnar Locker uses /tmp/<filename> /vmfs/volumes/<UUID>/. Pysa uses Python and passes the datastore path.
 30
 31#### Possible investigation steps
 32
 33- Read message for the executable path and the datastore argument.
 34- Check the same session for chmod +x, VM process kills, snapshot removal, and find commands for vmdk files.
 35- On the host, identify the file that was executed and whether it is still under /tmp or on a datastore.
 36
 37### False positive analysis
 38
 39Approved maintenance can run a known script from /tmp against a datastore. An unknown filename, especially after a chmod in the same session, is the ransomware launch pattern.
 40
 41### Response and remediation
 42
 43- If the program was not approved, isolate the host. Leave powered-on VMs running so their disks stay locked.
 44- Remove the file under /tmp and preserve shell.log.
 45- Restore any datastore that was modified from an off-host backup.
 46"""
 47references = [
 48    "https://lolesxi-project.github.io/LOLESXi/#",
 49    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
 50    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
 51]
 52setup = """## Setup
 53
 54This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
 55"""
 56risk_score = 73
 57rule_id = "4bfd7545-987a-5a19-a3c9-c3fba2858f29"
 58severity = "high"
 59tags = [
 60    "Domain: Endpoint",
 61    "Data Source: VMware vSphere",
 62    "Use Case: Threat Detection",
 63    "Tactic: Execution",
 64    "Tactic: Impact",
 65    "Resources: Investigation Guide",
 66    "Rule Type: Custom Query (KQL)",
 67    "Platform: VMware ESXi",
 68    "Threat: Ransomware",
 69]
 70timestamp_override = "event.ingested"
 71type = "query"
 72
 73query = '''
 74data_stream.dataset:vsphere.log and event.module:vsphere and message:("/vmfs/volumes" and ("/tmp/" or python))
 75'''
 76
 77[[rule.threat]]
 78framework = "MITRE ATT&CK"
 79[[rule.threat.technique]]
 80id = "T1059"
 81name = "Command and Scripting Interpreter"
 82reference = "https://attack.mitre.org/techniques/T1059/"
 83[[rule.threat.technique.subtechnique]]
 84id = "T1059.004"
 85name = "Unix Shell"
 86reference = "https://attack.mitre.org/techniques/T1059/004/"
 87
 88[rule.threat.tactic]
 89id = "TA0002"
 90name = "Execution"
 91reference = "https://attack.mitre.org/tactics/TA0002/"
 92
 93[[rule.threat]]
 94framework = "MITRE ATT&CK"
 95[[rule.threat.technique]]
 96id = "T1486"
 97name = "Data Encrypted for Impact"
 98reference = "https://attack.mitre.org/techniques/T1486/"
 99
100[rule.threat.tactic]
101id = "TA0040"
102name = "Impact"
103reference = "https://attack.mitre.org/tactics/TA0040/"
104
105[rule.investigation_fields]
106field_names = [
107    "@timestamp",
108    "message",
109    "event.original",
110    "host.hostname",
111    "log.file.path",
112]