Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
150 detections
Filters
Last updated
All Time
Detection languages
41
34
25
13
13
Contributors
30
26
18
11
11
Categories
62
57
32
28
19
Platforms
39,908
7,245
6,529
3,864
3,627
150
Products / Services
28
14
13
11
11
MITRE Techniques
52
51
42
35
23
CVEs
4
2
1
1
1
IDS Classtypes
8
4
1
IDS Protocols
12
Detects the execution of administrative commands and scripting interpreters spawned by the VMware Tools daemon (vmtoolsd), which may indicate an adversary leveraging ESXi guest operations for remote code execution.
Detects the modification or setting of the execInstalledOnly parameter to false, 0, or disabled on VMware ESXi or Linux hosts via process execution command lines or syslog messages, often associated with running uninstalled or arbitrary scripts/binaries in virtualized environments.
Detects coordinated malicious activity on VMware ESXi hosts indicative of ransomware attacks. The rule correlates multiple suspicious events within a 10-minute window, including the appearance of known ESXi ransom notes/banners, mass datastore file renames or encryption extensions, virtual machine stop events, and snapshot deletions designed to prevent recovery.
Detects when a large number of virtual machines are powered off by a single user or initiator within a short timeframe, which can be an indicator of malicious availability interruption or virtualization disruption (such as ransomware preparation).
Detects obfuscated shell command execution on VMware ESXi as hunted by CrowdStrike, where attackers hide esxcli commands (e.g. syslog config reset for log evasion, vm process list for recon) behind decode-and-execute wrappers such as printf hex/octal escapes, awk BEGIN blocks (chr/ord/xor/zero-width-unicode/morse/binary decoders), python -c chr() reconstruction, sed/od character-reversal ciphers, and $TERM/$SHELL substring reassembly, frequently invoking /usr/lib/vmware/busybox/bin/busybox or staging output in hidden /vmfs/volumes//.sys files before piping the reconstructed command into sh.
This is a living-off-the-land technique used to evade detection and hinder forensic reconstruction of attacker activity on ESXi hosts, and has been observed enabling syslog exfil-log evasion and VM/hypervisor reconnaissance.
This is a living-off-the-land technique used to evade detection and hinder forensic reconstruction of attacker activity on ESXi hosts, and has been observed enabling syslog exfil-log evasion and VM/hypervisor reconnaissance.
Detects a shell command referencing a hidden, octal/self-deleting payload
file written to a VMFS datastore volume using a '.sys' filename prefix followed by a
numeric timestamp, combined with an 'rm -f' cleanup of the same file. CrowdStrike observed
this VMFS staging technique used to blend a decoded payload in with legitimate system files
before it is executed and then removed as an anti-forensics step, denying incident
responders a copy of the payload from disk.
file written to a VMFS datastore volume using a '.sys' filename prefix followed by a
numeric timestamp, combined with an 'rm -f' cleanup of the same file. CrowdStrike observed
this VMFS staging technique used to blend a decoded payload in with legitimate system files
before it is executed and then removed as an anti-forensics step, denying incident
responders a copy of the payload from disk.
Detects evidence of exploitation and post-exploitation activity related to CVE-2026-59310, an unauthenticated RCE vulnerability in the VMware vCenter Syslog Server. The rule monitors for suspicious child processes spawned by vmsyslogcollector, directory traversal patterns in command lines, and persistence mechanisms involving SSH authorized_keys modification, cron job creation, or systemd unit deployment on the VCSA shell.
Detects awk-based shell command construction on ESX BusyBox that interleaves
an esxcli/vim-cmd command string with invisible Unicode code points (zero-width space,
zero-width non-joiner/joiner, word joiner, Mongolian vowel separator, left/right-to-left
marks, or Plane-16 private-use characters generated via sprintf hex escapes), strips them
with gsub(), and passes the result to system(). CrowdStrike documented this as one of 21
validated ESX obfuscation techniques that leaves only the invisible-character-laden string
in shell logs while the executed command is fully hidden from cleartext review.
an esxcli/vim-cmd command string with invisible Unicode code points (zero-width space,
zero-width non-joiner/joiner, word joiner, Mongolian vowel separator, left/right-to-left
marks, or Plane-16 private-use characters generated via sprintf hex escapes), strips them
with gsub(), and passes the result to system(). CrowdStrike documented this as one of 21
validated ESX obfuscation techniques that leaves only the invisible-character-laden string
in shell logs while the executed command is fully hidden from cleartext review.
Detects VMware ESXi shell activity associated with the ShinySp1d3r encryptor. This includes the termination of VM processes via esxcli or vim-cmd, the deletion of VM snapshots, and suspicious file renaming or encryption activity on datastores consistent with ransomware behaviors.
Detects high-risk administrative activity on VMware ESXi or vCenter servers that is consistent with pre-ransomware staging, such as disabling lockdown mode, disabling syslog forwarding, mass deletion or modification of virtual machine files (.vmdk/.vmx), or shell command execution related to encryption tool staging.
Detects unauthorized modifications to the .ssh/authorized_keys file. Such changes are often performed by adversaries to establish persistence by ensuring their own public keys allow them remote access to the host. The rule filters out known configuration management and system tools to reduce noise.
Detects the use of 'vim-cmd' or 'esxcli' to power off or terminate virtual machine processes on an ESXi host, which may indicate malicious activity such as ransom-related VM shutdown or service disruption.
Detects a suspected ransomware double-extortion sequence: the bulk creation of password-protected archives using compression utilities (e.g., 7z, RAR), followed by significant outbound network connections to common cloud storage or anonymization endpoints, and concluding with mass file modifications indicative of encryption activity.
Detects instances where a successful login occurs on an ESXi/vCenter hypervisor, followed by the creation or power-on of a virtual machine on that same host within a two-hour window. This behavior is indicative of an attacker establishing access to a hypervisor environment to spin up rogue, unmonitored virtual machines to evade detection tools and facilitate further malicious activity.
The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.
Detects successful administrative logins to VMware ESXi, vCenter, or related VDI infrastructure (Horizon) by users who have recently performed a password or MFA reset. This pattern is indicative of a helpdesk-based social engineering attack (vishing) or credential compromise where the attacker regains account access and immediately pivots to critical virtualization management infrastructure to facilitate ransomware deployment.
Detects the presence of PAYLOAD ransomware ELF binaries specifically configured to target VMware ESXi environments. The detection logic looks for a combination of ELF magic bytes, the 'PAYLOAD' string, references to common virtual machine file extensions (e.g., .vmdk, .vmx), and usage of ESXi-specific administration tools such as esxcli or vim-cmd.
Detects network activity related to the BEAST ransomware targeting VMware ESXi systems. The rule identifies attempts to stage encryption operations via SSH, including detecting references to known filenames ('encryptor.elf', 'beast_esxi') and the use of the 'vim-cmd' utility to power off virtual machines as part of the preparation for file encryption.
Detects suspicious activity on VMware ESXi hosts involving the termination or unregistration of virtual machines via 'esxcli' or 'vim-cmd', correlated with high volumes of file modification or creation events (.vmdk or .vmx files) within a short window. This pattern often indicates attempts to disrupt virtual machines or inhibit system recovery by adversaries.
Detects successful administrative logins to VMware ESXi, vCenter, or related VDI infrastructure (Horizon) by users who have recently performed a password or MFA reset. This pattern is indicative of a helpdesk-based social engineering attack (vishing) or credential compromise where the attacker regains account access and immediately pivots to critical virtualization management infrastructure to facilitate ransomware deployment.
Detects successful administrative logins to VMware ESXi, vCenter, or related VDI infrastructure (Horizon) by users who have recently performed a password or MFA reset. This pattern is indicative of a helpdesk-based social engineering attack (vishing) or credential compromise where the attacker regains account access and immediately pivots to critical virtualization management infrastructure to facilitate ransomware deployment.
Page 1 of 8