Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
4
3
1
Contributors
3
2
2
1
Categories
4
3
3
1
1
Platforms
7
2
1
Products / Services
3
2
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the execution of sensitive ESXi administrative commands (e.g., esxcli, vim-cmd) that suggest potential hypervisor management or tampering, especially when initiated by non-administrative processes or specific shells.
Detects the execution of sensitive ESXi administrative commands (e.g., esxcli, vim-cmd) that suggest potential hypervisor management or tampering, especially when initiated by non-administrative processes or specific shells.
This rule detects the upload of a vSphere Installation Bundle (VIB) to an ESXi host. It specifically looks for HTTP PUT requests to the '/bundle' URI with a payload size greater than 100,000 bytes, which is indicative of a VIB file transfer. This activity could be part of a persistence mechanism where an attacker installs malicious software or backdoors on an ESXi host.
This rule detects the potentially malicious installation of VMware Installation Bundles (VIBs) on an ESXi host using the `--force` flag. The `--force` option bypasses critical signature and compatibility checks, which is uncommon in normal administrative operations. This behavior is often observed in post-compromise scenarios where adversaries install backdoored or unauthorized kernel modules, drivers, or monitoring tools to establish persistence or gain deeper control of the hypervisor.
This detection identifies changes to the VIB (vSphere Installation Bundle) acceptance level on an ESXi host. Modifying the acceptance level, such as setting it to CommunitySupported, lowers the system's integrity enforcement and may allow the installation of unsigned or unverified software. This action can be an indicator of an adversary attempting to install malicious VIBs for persistence or other malicious activities.
This detection identifies failed file download attempts on ESXi hosts by looking for specific error messages in the system logs. These failures may indicate unauthorized or malicious attempts to install or update components—such as VIBs or scripts
KQL Query from file: CVE-2025-22224 (CVSS 9.3 CRITICAL) Internet facing VMware server discovery
KQL Query from file: Detect Copilot Plugin Installation