Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
30 detections
Filters
Last updated
All Time
Detection languages
20
6
2
2
Contributors
18
7
2
1
1
Categories
16
14
10
6
3
Platforms
21
14
5
Products / Services
11
3
2
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
2
Detects a sequence of events on a single host within a 10-minute window involving both the deletion of Volume Shadow Copies (using vssadmin.exe or wmic.exe) and the execution of ESXi management commands (using esxcli or vmware binaries). This behavioral pattern is often indicative of ransomware attempting to inhibit system recovery and interfere with virtualized infrastructure components concurrently.
Detects a sequence of events on a single host within a 10-minute window involving both the deletion of Volume Shadow Copies (using vssadmin.exe or wmic.exe) and the execution of ESXi management commands (using esxcli or vmware binaries). This behavioral pattern is often indicative of ransomware attempting to inhibit system recovery and interfere with virtualized infrastructure components concurrently.
Detects the execution of sensitive ESXi administrative commands (e.g., esxcli, vim-cmd) that suggest potential hypervisor management or tampering, especially when initiated by non-administrative processes or specific shells.
Detects the use of VMware ESXi command-line management tools (esxcli, esxcfg) or VMware PowerCLI cmdlets (e.g., Connect-VIServer, Invoke-VMScript) from endpoints that are not identified as servers. This behavior often indicates an attacker attempting to manage or interact with a virtualized environment from a compromised workstation.
Detects the use of VMware ESXi command-line management tools (esxcli, esxcfg) or VMware PowerCLI cmdlets (e.g., Connect-VIServer, Invoke-VMScript) from endpoints that are not identified as servers. This behavior often indicates an attacker attempting to manage or interact with a virtualized environment from a compromised workstation.
Detects the execution of sensitive ESXi administrative commands (e.g., esxcli, vim-cmd) that suggest potential hypervisor management or tampering, especially when initiated by non-administrative processes or specific shells.
Detects the use of VMware ESXi command-line management tools (esxcli, esxcfg) or VMware PowerCLI cmdlets (e.g., Connect-VIServer, Invoke-VMScript) from endpoints that are not identified as servers. This behavior often indicates an attacker attempting to manage or interact with a virtualized environment from a compromised workstation.
This rule detects attempts to access the ESXi Hypervisor Command Line Interface (CLI) via HTTPS. It specifically looks for HTTP requests to the '/sdk' and 'vim25' URIs on port 443, which are indicative of vSphere API or CLI interactions with an ESXi host.
This rule detects attempts to establish a TCP connection to port 902 on the home network, which is commonly used for VMware ESXi management. The rule specifically looks for SYN packets (flags:S) and triggers if there are at least 3 such connection attempts from the same source within a 60-second window. This could indicate an attempt to access or scan the ESXi management interface.
Detects the use of esxcfg-advcfg to alter the BufferCache settings on an ESXi host. This activity can be a precursor to bulk file encryption, as seen with the 'Gentlemen Linux variant' which modifies VMFS write buffer and flush interval to prepare ESXi hosts for fast, reliable encryption.
Detects changes to the ESXi syslog configuration via "esxcli"
Detects the disabling of the VMware ESXi firewall using 'esxcli', a technique used by the RansomHouse 'MrAgent' tool as a defense evasion tactic before encryption.
Detects the execution of the ESXi command 'esxcli network firewall set --enabled false' used by the RansomHouse MrAgent deployment tool to disable the host's firewall. This is a defense evasion technique used to ensure C2 communication and subsequent ransomware deployment.
This rule detects the execution of the 'esxcli' command on an ESXi host with specific arguments to assign administrative permissions to an account. The command line must contain 'system', 'permission', 'set', and 'Admin', indicating an attempt to modify user permissions to grant administrative privileges. This activity is highly suspicious as it can lead to privilege escalation or persistence on the hypervisor.
Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.
Detects the execution of the "esxcli" command with the "vm" and "kill" flags, indicating an attempt to terminate or shut down a specific virtual machine on an ESXi hypervisor. This activity can be indicative of malicious actions such as ransomware attacks targeting virtualized environments.
Detects the creation of a new user account on an ESXi system using the 'esxcli' command-line interface. This activity can be an indicator of an adversary establishing persistence or gaining unauthorized access to the hypervisor.
Detects the execution of the 'esxcli' command with the 'vm' flag to retrieve information about installed virtual machines on an ESXi hypervisor. This activity can be part of discovery phase by adversaries targeting ESXi environments.
Detects the execution of the "esxcli" command with the "network" flag to retrieve information about the network configuration on an ESXi host. This activity can be indicative of an adversary performing discovery.
Detects the execution of the 'esxcli' command with the 'system' flag, combined with 'get' or 'list' subcommands, to retrieve information about various system components on an ESXi host. This can include details about accounts, modules, NTP settings, and other system configurations.
Detects the execution of the 'esxcli' command with the 'storage' flag to retrieve information about storage status on VMware ESXi systems. This activity has been observed in malware campaigns, including DarkSide and LockBit ransomware.
Page 1 of 2