Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
5
2
Contributors
5
2
Categories
4
3
3
2
2
Platforms
7
4
Products / Services
5
3
2
2
1
MITRE Techniques
6
5
5
2
1
CVEs
71
71
64
58
49
This analytic detects attempts to create an "ESX Admins" group using the Windows net.exe or net1.exe commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the "ESX Admins" group after its deletion from Active Directory.
Detects the creation or modification of a Windows domain group named "ESX Admins". This activity is suspicious because VMware ESXi hypervisors joined to an Active Directory domain grant full administrative access by default to members of a group with this specific name. This could indicate a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate privileges on a domain-joined ESXi hypervisor.
This rule detects the creation of a domain group named "ESX Admins" using either `net.exe` or PowerShell cmdlets like `New-ADGroup`. This activity is highly suspicious and indicates a potential exploitation attempt of CVE-2024-37085. This vulnerability allows an attacker to elevate privileges to full administrative access on a domain-joined ESXi hypervisor, as VMware ESXi hypervisors grant full administrative access by default to members of a domain group named "ESX Admins".
This analytic detects the creation, deletion, or modification of the "ESX Admins" group in Active Directory. These events may indicate attempts to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085).
This analytic detects attempts to create an "ESX Admins" group using PowerShell commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the 'ESX Admins' group after its deletion from Active Directory.
This analytic detects attempts to create an "ESX Admins" group using the Windows net.exe or net1.exe commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the "ESX Admins" group after its deletion from Active Directory.
This analytic detects modifications to privileged groups in Active Directory, including creation, deletion, and changes to various types of groups such as local, global, universal, and LDAP query groups. It specifically monitors for changes to high-privilege groups like "Administrators", "Domain Admins", "Enterprise Admins", and "ESX Admins", among others. This detection is particularly relevant in the context of potential exploitation of vulnerabilities like the VMware ESXi Active Directory Integration Authentication Bypass (CVE-2024-37085), where attackers may attempt to manipulate privileged groups to gain unauthorized access to systems.