CVE-2024-37085 | Detection.FYI

Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group

Jun 2, 2025 · attack.execution cve.2024-37085 detection.emerging-threats ·
Share on:

Detects execution of the "net.exe" command in order to add a group named "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

Read More
Potential Exploitation of CVE-2024-37085 - Suspicious ESX Admins Group Activity

Jun 2, 2025 · attack.execution cve.2024-37085 detection.emerging-threats ·
Share on:

Detects any creation or modification to a windows domain group with the name "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

Read More