ESXi VM Escape Exploit - MAESTRO Orchestrator
This rule set detects various components and behaviors associated with the MAESTRO ESXi VM escape exploit. It identifies the orchestrator (exploit.exe), the MyDriver.sys unsigned kernel driver, the GetShell Plugin client, the VSOCKpuppet backdoor, the usage of Kernel Driver Utility (KDU) to load the exploit driver, and several behavioral indicators. The indicators include disabling the VMCI driver, using InfDefaultInstall, VSOCK communication, modifying inetd.conf, and artifacts with Chinese characters. The overall goal is to detect the full attack chain from initial exploit deployment to persistent backdoor access on ESXi hypervisors.
YARA
