ESXi System Information Discovery Via ESXCLI
Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.
Sigma rule (View on GitHub)
1title: ESXi System Information Discovery Via ESXCLI
2id: e80273e1-9faf-40bc-bd85-dbaff104c4e9
3status: test
4description: Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.
5references:
6 - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
7 - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
8author: Cedric Maurugeon
9date: 2023-09-04
10tags:
11 - attack.discovery
12 - attack.execution
13 - attack.t1033
14 - attack.t1007
15 - attack.t1059.012
16logsource:
17 category: process_creation
18 product: linux
19detection:
20 selection_img:
21 Image|endswith: '/esxcli'
22 CommandLine|contains: 'system'
23 selection_cli:
24 CommandLine|contains:
25 - ' get'
26 - ' list'
27 condition: all of selection_*
28falsepositives:
29 - Legitimate administration activities
30level: medium
References
Related rules
- ESXi Network Configuration Discovery Via ESXCLI
- ESXi Storage Information Discovery Via ESXCLI
- ESXi VM List Discovery Via ESXCLI
- ESXi VSAN Information Discovery Via ESXCLI
- HackTool - PCHunter Execution