ESX BusyBox - Obfuscated esxcli Syslog Disable
Detects execution of esxcli syslog configuration commands where the command itself is reconstructed at runtime from hex escape sequences, octal escape sequences, an awk BEGIN block, or a Python chr()-based decoder before being reset against loghost. CrowdStrike cataloged this pattern across 21 ESX BusyBox obfuscation techniques used to hide 'esxcli system syslog config set --reset=loghost' from cleartext shell log review. Threat actors including SCATTERED SPIDER, BlackBasta, Royal/BlackSuit, and Akira use this to sever centralized log forwarding from a compromised ESXi host immediately before encrypting the datastore.
YARA-L
