Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
16 detections
Filters
Last updated
All Time
Detection languages
8
4
2
1
1
Contributors
6
3
2
2
1
Categories
8
7
4
3
3
Platforms
11
4
4
2
2
Products / Services
4
2
2
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
IDS Protocols
4
Detects the execution of administrative commands and scripting interpreters spawned by the VMware Tools daemon (vmtoolsd), which may indicate an adversary leveraging ESXi guest operations for remote code execution.
Detects the modification or setting of the execInstalledOnly parameter to false, 0, or disabled on VMware ESXi or Linux hosts via process execution command lines or syslog messages, often associated with running uninstalled or arbitrary scripts/binaries in virtualized environments.
This rule detects modifications to critical AI agent configurations—such as system prompts, tool allowlists, permission scopes, or model parameters—by users who are not part of the authorized 'agent-ops' group. It flags potentially high-risk changes, particularly when those changes fall outside established maintenance windows or involve an expansion of agent permissions.
Detects enabling of ESXi host shell via vSphere API for remote execution
Detects ESXi hypervisor CLI access via direct SSH connection
This rule detects an attempt to access the ESXi direct SSH shell by looking for the 'vim-cmd' string in TCP traffic directed to port 22 (SSH) on the home network. This indicates an administrative command being executed directly on an ESXi host via SSH.
This rule detects attempts to enable the ESXi Host Shell via the vCenter Web API. It specifically looks for HTTP requests to the '/api/vcenter/host' URI containing the word 'shell' in the client body, indicating a potential administrative action to enable shell access on an ESXi host.
This rule detects network traffic destined for TCP port 902 on the home network, which is commonly used for ESXi vSphere management. The rule specifically looks for established TCP connections to this port and triggers an alert if five such connections are observed from the same source within a 30-second window. This could indicate management activity or potential reconnaissance/attack against ESXi hosts.
This rule detects HTTP POST requests to the '/sdk/vimService' URI on TCP port 443 (HTTPS) targeting an ESXi host. This pattern is indicative of direct API command execution attempts against the VMware vSphere API, which could be used by an attacker to interact with or control the ESXi hypervisor.
The following analytic identifies child processes spawned by vmtoolsd.exe, the VMWare Tools service in Windows, which typically runs with SYSTEM privileges. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. Monitoring this activity is crucial as it can indicate exploitation attempts, such as CVE-2023-20867. If confirmed malicious, attackers could gain SYSTEM-level access, allowing them to execute arbitrary code, escalate privileges, and potentially compromise the entire system.
This detection identifies changes to the syslog configuration on an ESXi host using `esxcli`, which may indicate an attempt to disrupt log collection and evade detection. Adversaries may modify logging configurations to hinder forensic analysis and remain undetected.
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
KQL Query
KQL Query from file: CVE-2025-22224 (CVSS 9.3 CRITICAL) Internet facing VMware server discovery
Looks for multiple users that had their admin role removed by a single user within a certain period.
'Looks for multiple users that had their admin role removed by a single user within a certain period.
The default threshold is 5 removals, this can be edited in the query.'
The default threshold is 5 removals, this can be edited in the query.'