Potential Exploitation of CVE-2024-37085 - Suspicious ESX Admins Group Activity

SigmaHQ Detections@sigmaHQ

•updated Jun 2, 2025•0•26

Detects the creation or modification of a Windows domain group named "ESX Admins". This activity is suspicious because VMware ESXi hypervisors joined to an Active Directory domain grant full administrative access by default to members of a group with this specific name. This could indicate a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate privileges on a domain-joined ESXi hypervisor.