Detection rules for VMware ESXi Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 14 detection rules.

Rule Example

Below is an example of a rule definition for ESXi Direct SSH Login Detection (view in repository):

# Rule version v1.0.0

dataTypes:
  - vmware-esxi
name: ESXi Direct SSH Login Detection
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Remote Access
technique: "T1021.004 - Remote Services: SSH"
adversary: origin
references:
  - https://kb.vmware.com/s/article/1017910
  - https://attack.mitre.org/techniques/T1021/004/
description: |
  Detects direct SSH login to ESXi hosts, which is a security concern as ESXi management should primarily be done through vCenter. Direct SSH access is commonly used by attackers for ransomware deployment and post-exploitation activities.

  Next Steps:
  1. Verify the SSH login was from an authorized administrator
  2. Check if SSH was enabled as part of authorized maintenance
  3. Review commands executed during the SSH session
  4. Disable SSH access after maintenance is complete
  5. Implement SSH access controls and key-based authentication
  6. Monitor for post-login suspicious activity
where: |
  exists("log.message") &&
  (
    (contains("log.message", "SSH") && contains("log.message", "login")) ||
    (contains("log.message", "sshd") && contains("log.message", "Accepted")) ||
    (contains("log.message", "SSH session") && contains("log.message", "opened")) ||
    (contains("log.message", "SSH") && contains("log.message", "enabled")) ||
    (contains("log.message", "ssh") && contains("log.message", "connection from"))
  )
groupBy:
  - adversary.hostname
  - adversary.ip

Rule Details

ESXi Direct SSH Login Detection

Identifies direct SSH logins to ESXi hosts, a security risk since ESXi management should normally occur through vCenter. Attackers frequently use direct SSH access for ransomware deployment and post-exploitation activity.

• Category: Remote Access

• Technique: T1021.004 - Remote Services: SSH

• Impact: C:3 / I:3 / A:2

• Rule file: esxi_ssh_access.yml

• Reference: https://kb.vmware.com/s/article/1017910

• Reference: https://attack.mitre.org/techniques/T1021/004/

ESXi Firewall Rule Modification Detection

Identifies changes to ESXi firewall ruleset configurations made through esxcli network firewall commands. Attackers alter firewall rules to allow outbound connections for C2 communication or to expose management interfaces.

• Category: Defense Evasion

• Technique: T1562.004 - Impair Defenses: Disable or Modify System Firewall

• Impact: C:2 / I:3 / A:2

• Rule file: esxi_firewall_modification.yml

• Reference: https://kb.vmware.com/s/article/2008226

• Reference: https://attack.mitre.org/techniques/T1562/004/

ESXi Host Compromise Indicators

Identifies signs of ESXi host compromise, such as ransomware preparation, suspicious file operations on virtual machines, logging tampering, and abnormal system changes. It monitors for encryption tools, VM power operations, and file system modifications.

• Category: Execution

• Technique: T1059 - Command and Scripting Interpreter

• Impact: C:3 / I:3 / A:3

• Rule file: esxi_host_compromise.yml

• Reference: https://www.forescout.com/blog/vmware-esxi-servers-a-major-attack-vector-for-ransomware/

• Reference: https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass

• Reference: https://attack.mitre.org/techniques/T1059/

ESXi Local Account Manipulation Detection

Identifies the creation or modification of local ESXi user accounts. Attackers establish backdoor accounts on ESXi hosts to maintain persistent access, or alter existing accounts to escalate privileges.

• Category: Persistence

• Technique: T1098 - Account Manipulation

• Impact: C:3 / I:3 / A:2

• Rule file: esxi_account_manipulation.yml

• Reference: https://kb.vmware.com/s/article/1006530

• Reference: https://attack.mitre.org/techniques/T1098/

ESXi Ransomware Attack Detection

Flags ESXi ransomware attack patterns such as mass VM shutdown, indications of VMDK encryption, suspicious script execution, and removal of VM snapshots. ESXiArgs and comparable ransomware families target ESXi hosts in order to encrypt virtual machine disk files.

• Category: Impact

• Technique: T1486 - Data Encrypted for Impact

• Impact: C:3 / I:3 / A:3

• Rule file: esxi_ransomware_detection.yml

• Reference: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-039a

• Reference: https://attack.mitre.org/techniques/T1486/

ESXi Syslog Forwarding Disruption Detection

Identifies attempts to disable or alter ESXi syslog forwarding in order to prevent security monitoring. Attackers turn off syslog to operate without being detected by the SIEM.

• Category: Defense Evasion

• Technique: T1562.002 - Impair Defenses: Disable Windows Event Logging

• Impact: C:1 / I:3 / A:2

• Rule file: esxi_syslog_disruption.yml

• Reference: https://kb.vmware.com/s/article/2003322

• Reference: https://attack.mitre.org/techniques/T1562/002/

ESXi Unsigned VIB Installation Detection

Identifies installation of unsigned or community-supported VIB (vSphere Installation Bundle) packages on ESXi hosts. APT groups leverage malicious VIBs to maintain persistent backdoor access to hypervisors that remain through reboots and updates.

• Category: Persistence

• Technique: T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain

• Impact: C:3 / I:3 / A:3

• Rule file: esxi_vib_sideloading.yml

• Reference: https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence

• Reference: https://attack.mitre.org/techniques/T1195/002/

ESXi Virtual Disk Theft Detection

Identifies possible theft of virtual machine disk files (.vmdk) via Datastore Browser downloads, SCP transfers, or unauthorized vmkfstools operations. Attackers exfiltrate VMDK files to acquire complete system images.

• Category: Collection

• Technique: T1005 - Data from Local System

• Impact: C:3 / I:1 / A:1

• Rule file: esxi_disk_theft.yml

• Reference: https://attack.mitre.org/techniques/T1005/

PowerCLI Script Execution Detection

Identifies PowerCLI script execution on VMware ESXi hosts by monitoring authentication events and command execution patterns linked to MS Web Services Client Protocol, which is specific to PowerCLI connections. PowerCLI is VMware's powerful command-line tool, and attackers can use it for reconnaissance, lateral movement, or persistence on virtualized infrastructure.

• Category: Execution

• Technique: T1059 - Command and Scripting Interpreter

• Impact: C:3 / I:3 / A:2

• Rule file: powercli_script_execution.yml

• Reference: https://attack.mitre.org/techniques/T1059/

• Reference: https://blogs.vmware.com/vsphere/2013/07/capturing-logins-to-esxi-by-a-root-account.html

VMware ESXi Hypervisor Escape Attempt Detection

Identifies possible hypervisor escape attempts via suspicious VMX process activity, abnormal privilege escalation, or unauthorized access to host resources from guest VMs. This rule detects multiple indicators of compromise, such as CVE-2024-37085 exploitation, VMCI backdoor attempts, and unauthorized vpxuser activities.

• Category: Privilege Escalation

• Technique: T1611 - Escape to Host

• Impact: C:3 / I:3 / A:3

• Rule file: hypervisor_escape_attempts.yml

• Reference: https://attack.mitre.org/techniques/T1611/

• Reference: https://www.usenix.org/system/files/woot19-paper_zhao.pdf

• Reference: https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-F35D7005-58EB-48AC-99D5-B9942EB2A8EF.html

VMware Tools Vulnerability Exploitation

Identifies possible exploitation of VMware Tools vulnerabilities by monitoring suspicious authentication events, command execution patterns, and error messages tied to VMware Tools operations. Vulnerabilities in VMware Tools can be exploited to gain unauthorized access to virtual machines or to escalate privileges within the virtualized environment.

• Category: Initial Access

• Technique: T1190 - Exploit Public-Facing Application

• Impact: C:3 / I:3 / A:2

• Rule file: vmware_tools_vulnerabilities.yml

• Reference: https://attack.mitre.org/techniques/T1190/

• Reference: https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-F35D7005-58EB-48AC-99D5-B9942EB2A8EF.html

VMware vCenter Server Attack Indicators

Identifies possible attacks against vCenter Server, including authentication anomalies, privilege escalation attempts, and suspicious command execution. It monitors for indicators of compromise, such as unusual SSH enablement, service modifications, and administrative group changes.

• Category: Initial Access

• Technique: T1190 - Exploit Public-Facing Application

• Impact: C:3 / I:3 / A:3

• Rule file: vcenter_server_attacks.yml

• Reference: https://us-cert.cisa.gov/ncas/alerts/aa22-138b

• Reference: https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html

• Reference: https://attack.mitre.org/techniques/T1190/

Virtual Machine Escape Detection

Identifies VM escape attempts via abnormal guest operations, suspicious VMware Tools activity, or efforts to access host resources from guest VMs. VM escape is a critical security event in which an attacker breaks out of virtual machine containment to reach the hypervisor or host system.

• Category: Privilege Escalation

• Technique: T1611 - Escape to Host

• Impact: C:3 / I:3 / A:3

• Rule file: vm_escape_detection.yml

• Reference: https://attack.mitre.org/techniques/T1611/

• Reference: https://www.csoonline.com/article/3837874/vmware-esxi-gets-critical-patches-for-in-the-wild-virtual-machine-escape-attack.html

• Reference: https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html

vSphere API Abuse Detection

Identifies possible vSphere API abuse, such as unauthorized access attempts, suspicious API calls, and exploitation attempts. It monitors for authentication failures, unusual vpxuser activity, and rapid API requests that may indicate compromise or abuse of VMware vSphere infrastructure.

• Category: Lateral Movement

• Technique: T1210 - Exploitation of Remote Services

• Impact: C:3 / I:3 / A:2

• Rule file: vsphere_api_abuse.yml

• Reference: https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass

• Reference: https://attack.mitre.org/techniques/T1210/