ESX VMFS - Hidden .sys Payload Drop and Self-Delete
Detects a shell command referencing a hidden, octal/self-deleting payload file written to a VMFS datastore volume using a '.sys' filename prefix followed by a numeric timestamp, combined with an 'rm -f' cleanup of the same file. CrowdStrike observed this VMFS staging technique used to blend a decoded payload in with legitimate system files before it is executed and then removed as an anti-forensics step, denying incident responders a copy of the payload from disk.
YARA-L
