ESXi System Information Discovery Via ESXCLI

 1title: ESXi System Information Discovery Via ESXCLI
 2id: e80273e1-9faf-40bc-bd85-dbaff104c4e9
 3status: test
 4description: Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.
 5references:
 6    - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
 7    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
 8author: Cedric Maurugeon
 9date: 2023-09-04
10tags:
11    - attack.discovery
12    - attack.execution
13    - attack.t1033
14    - attack.t1007
15    - attack.t1059.012
16logsource:
17    category: process_creation
18    product: linux
19detection:
20    selection_img:
21        Image|endswith: '/esxcli'
22        CommandLine|contains: 'system'
23    selection_cli:
24        CommandLine|contains:
25            - ' get'
26            - ' list'
27    condition: all of selection_*
28falsepositives:
29    - Legitimate administration activities
30level: medium

References

• Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware

  CrowdStrike outlines the new campaigns that have been observed targeting ESXi systems and specific defensive controls that can protect these critical assets.

  
  Read More

• ESXCLI Commands | ESXCLI Command Reference

  Command Description Options Help system account add Create a new local user account. --description | -d User description, e.g. full name. --id | -i User ID, e.g. "administrator". (required) --passw...

  
  Read More

Related rules

• ESXi Network Configuration Discovery Via ESXCLI
• ESXi Storage Information Discovery Via ESXCLI
• ESXi VM List Discovery Via ESXCLI
• ESXi VSAN Information Discovery Via ESXCLI
• HackTool - PCHunter Execution