ESXi VM List Discovery Via ESXCLI

 1title: ESXi VM List Discovery Via ESXCLI
 2id: 5f1573a7-363b-4114-9208-ad7a61de46eb
 3status: test
 4description: Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.
 5references:
 6    - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
 7    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html
 8    - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/
 9    - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html
10author: Cedric Maurugeon
11date: 2023-09-04
12tags:
13    - attack.discovery
14    - attack.t1033
15    - attack.t1007
16logsource:
17    category: process_creation
18    product: linux
19detection:
20    selection:
21        Image|endswith: '/esxcli'
22        CommandLine|contains: 'vm process'
23        CommandLine|endswith: ' list'
24    condition: selection
25falsepositives:
26    - Legitimate administration activities
27level: medium

References

• Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware

  CrowdStrike outlines the new campaigns that have been observed targeting ESXi systems and specific defensive controls that can protect these critical assets.

  
  Read More

• ESXCLI Commands | ESXCLI Command Reference

  To prevent this message from showing again, please enable pop-up blockers for support.broadcom.com or click Continue to proceed.

  
  Read More

• Analysis of ESXiArgs Ransomware | SECUINFRA

  

  In this blog post the SECUINFRA Falcon Team analyzes the recent “ESXiArgs” Ransomware variant.

  
  Read More

• New Linux-Based Ransomware Cheerscrypt Targets ESXi Devices

  

  New findings showed that Cheerscrypt, a new Linux-based ransomware variant that compromises ESXi servers, was derived from the leaked Babuk source code. We discuss our analysis in this report.

  
  Read More

Related rules

• ESXi Network Configuration Discovery Via ESXCLI
• ESXi Storage Information Discovery Via ESXCLI
• ESXi System Information Discovery Via ESXCLI
• ESXi VSAN Information Discovery Via ESXCLI
• Whoami.EXE Execution Anomaly