ESXi Storage Information Discovery via ESXCLI

SigmaHQ Detections@sigmaHQ

•updated May 21, 2025•1•0•29

Detects the execution of the 'esxcli' command with the 'storage' flag to retrieve information about storage status on VMware ESXi systems. This activity has been observed in malware campaigns, including DarkSide and LockBit ransomware.