ESXi VM Kill Via ESXCLI

 1title: ESXi VM Kill Via ESXCLI
 2id: 2992ac4d-31e9-4325-99f2-b18a73221bb2
 3status: experimental
 4description: Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.
 5references:
 6    - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
 7    - https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_vm.html
 8    - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/
 9    - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html
10author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
11date: 2023/09/04
12tags:
13    - attack.execution
14logsource:
15    category: process_creation
16    product: linux
17detection:
18    selection:
19        Image|endswith: '/esxcli'
20        CommandLine|contains|all:
21            - 'vm process'
22            - 'kill'
23    condition: selection
24falsepositives:
25    - Legitimate administration activities
26level: medium

References

• Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware

  

  CrowdStrike outlines the new campaigns that have been observed targeting ESXi systems and specific defensive controls that can protect these critical assets.

  
  Read More

• ESXCLI Reference - ESXi 7.0 ESXCLI Command Reference

  ESXCLI Reference The ESXCLI command set allows you to run common system administration commands against vSphere systems from an administration server of your choice. The actual list of commands dep...

  
  Read More

• Analysis of ESXiArgs Ransomware | SECUINFRA

  

  In this blog post the SECUINFRA Falcon Team analyzes the recent “ESXiArgs” Ransomware variant.

  
  Read More

• New Linux-Based Ransomware Cheerscrypt Targets ESXi Devices

  

  New findings showed that Cheerscrypt, a new Linux-based ransomware variant that compromises ESXi servers, was derived from the leaked Babuk source code. We discuss our analysis in this report.

  
  Read More

Related rules

• ESXi Admin Permission Assigned To Account Via ESXCLI
• Possible Impacket DCOMExec Connection Attempt - Zeek
• HackTool - CrackMapExec Execution
• Interactive Bash Suspicious Children
• Linux Reverse Shell Indicator