ESXi VSAN Information Discovery Via ESXCLI

SigmaHQ Detections@sigmaHQ

•updated May 21, 2025•1•0•29

Detects the execution of the "esxcli" command with the "vsan" flag to gather information about virtual storage on VMware ESXi systems. This activity has been observed in malware campaigns, including DarkSide and LockBit ransomware, indicating potential reconnaissance or preparation for impact on virtualized environments.