Potential Exploitation of CVE-2024-37085 - Suspicious Creation of ESX Admins Group

SigmaHQ Detections@sigmaHQ

•updated Jun 2, 2025•0•23

This rule detects the creation of a domain group named "ESX Admins" using either `net.exe` or PowerShell cmdlets like `New-ADGroup`. This activity is highly suspicious and indicates a potential exploitation attempt of CVE-2024-37085. This vulnerability allows an attacker to elevate privileges to full administrative access on a domain-joined ESXi hypervisor, as VMware ESXi hypervisors grant full administrative access by default to members of a domain group named "ESX Admins".