Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
150 detections
Filters
Last updated
All Time
Detection languages
41
34
25
13
13
Contributors
30
26
18
11
11
Categories
62
57
32
28
19
Platforms
39,920
7,245
6,529
3,864
3,627
150
Products / Services
28
14
13
11
11
MITRE Techniques
52
51
42
35
23
CVEs
4
2
1
1
1
IDS Classtypes
8
4
1
IDS Protocols
12
Matches published GRIMBOLT/SLAYSTYLE/BRICKSTORM hashes from RecoverPoint VM intrusions.
This detection identifies the execution of iptables commands used to implement Single Packet Authorization (SPA). This technique was observed being used by UNC6201 on compromised VMware appliances to create stealthy, conditional network proxies for C2 traffic. The rule looks for specific command-line arguments indicative of SPA setup, including rules for 'magic packet' detection, dynamic IP list management using the 'recent' module, and traffic redirection.
Detects access to VMware virtual disk files (.vmdk). This technique was
observed being used by the Muddled Libra (Scattered Spider) threat group,
where they would power down Domain Controllers, mount their disks to a rogue
VM, and steal the NTDS.dit and SYSTEM hives for offline credential extraction.
This method bypasses security monitoring that would typically occur on the
Domain Controller itself.
observed being used by the Muddled Libra (Scattered Spider) threat group,
where they would power down Domain Controllers, mount their disks to a rogue
VM, and steal the NTDS.dit and SYSTEM hives for offline credential extraction.
This method bypasses security monitoring that would typically occur on the
Domain Controller itself.
VM Escape VMware VMCI Device Disabling
Cortex XDR
This rule detects attempts to disable VMware VMCI (Virtual Machine Communication Interface) devices using 'devcon.exe'. This activity can be indicative of a VM escape attempt, as disabling VMCI might be a step to bypass security mechanisms or facilitate further exploitation within a virtualized environment. The rule specifically looks for 'devcon.exe' executing with 'disable' in the command line, targeting either 'PCI\VEN_15AD&DEV_0740' (VMCI device) or 'ROOT\VMWVMCIHOSTDEV' (VMCI host device).
Detects the use of the Microsoft Device Console (devcon.exe) to disable VMware Virtual Machine Communication Interface (VMCI) devices. This is a preparatory step observed in the 'MAESTRO' toolkit to gain exclusive hardware access before loading a malicious driver for a VM escape exploit.
Detects the execution of the command to stop the vCenter remote management service (vpxa) on an ESXi host. This is a technique used by the RansomHouse MrAgent tool to inhibit system recovery and impair defenses before deploying the Mario encryptor.
Detects the renaming of VMware virtual machine related files to a new file ending with the '.emario' extension. This behavior is characteristic of the RansomHouse 'Mario' encryptor.
Detects the disabling of the VMware ESXi firewall using 'esxcli', a technique used by the RansomHouse 'MrAgent' tool as a defense evasion tactic before encryption.
Detects the MrAgent binary, a deployment tool used in RansomHouse operations to manage compromised ESXi hosts and deploy the 'Mario' encryptor.
Detects the execution of the ESXi command 'esxcli network firewall set --enabled false' used by the RansomHouse MrAgent deployment tool to disable the host's firewall. This is a defense evasion technique used to ensure C2 communication and subsequent ransomware deployment.
Detects the renaming of critical virtualization files by the RansomHouse 'Mario' encryptor, which appends an extension containing '.mario' (e.g., '.emario'). This activity is a strong indicator of a successful encryption event on an ESXi host.
Detects potential WARP PANDA Junction implant activity by identifying processes, other than the legitimate 'vvold' service, listening on TCP port 8090. The Junction implant uses this port to masquerade and receive commands.
Detects the attachment of a virtual disk (.vmdk) likely belonging to a Domain Controller to another virtual machine. This technique is used by threat actors like SCATTERED SPIDER to access the Active Directory database (ntds.dit) for offline credential dumping. This is often done on a newly created, attacker-controlled VM.
This rule detects the execution of the 'esxcli' command on an ESXi host with specific arguments to assign administrative permissions to an account. The command line must contain 'system', 'permission', 'set', and 'Admin', indicating an attempt to modify user permissions to grant administrative privileges. This activity is highly suspicious as it can lead to privilege escalation or persistence on the hypervisor.
This detection identifies signs of SSH brute-force attacks by monitoring for a high number of failed login attempts within a short time frame. Such activity may indicate an attacker attempting to gain unauthorized access through password guessing.
This detection identifies SSH being enabled on ESXi hosts. Enabling SSH on ESXi can be an early indicator of malicious activity, as threat actors often use SSH to gain persistent remote access after compromising credentials or exploiting vulnerabilities. The rule specifically looks for syslog messages indicating that SSH access has been enabled.
Detects potential exploitation of VMware CVE-2025-41244, where a privileged VMware service discovery script executes a binary from a world-writable directory like /tmp. This behavior is consistent with the local privilege escalation technique used by UNC5174.
Detects a high volume of file rename operations where files are appended with a randomized 16-character hexadecimal extension. This is a characteristic behavior of LockBit 5.0 ransomware during its encryption phase.
Detects the creation of the Active Directory group "ESX Admins". Threat actors create this group to exploit CVE-2024-37085, which grants any member of this group administrative privileges on domain-joined VMware ESXi hypervisors.
This rule detects the potentially malicious installation of VMware Installation Bundles (VIBs) on an ESXi host using the `--force` flag. The `--force` option bypasses critical signature and compatibility checks, which is uncommon in normal administrative operations. This behavior is often observed in post-compromise scenarios where adversaries install backdoored or unauthorized kernel modules, drivers, or monitoring tools to establish persistence or gain deeper control of the hypervisor.
Detects the reconfiguration of a virtual machine where a virtual disk (.vmdk) from a different, often critical, VM is attached. This is a key tactic used by threat actors like UNC3944 to perform offline credential theft by mounting a Domain Controller's disk to a staging VM to access the NTDS.dit file.
Page 5 of 8