{"id":"2992ac4d-31e9-4325-99f2-b18a73221bb2","title":"ESXi VM Kill Via ESXCLI","description":"Detects execution of the \"esxcli\" command with the \"vm\" and \"kill\" flag in order to kill/shutdown a specific VM.","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":"","tags":["attack.execution","attack.impact","attack.t1059.012","attack.t1529"],"technique_ids":["T1059.012","T1529"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate administration activities"],"references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html","https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/","https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"],"source_path":"rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml","source_sha256":"9052329d4351d8db7be6063f5c8484dfd4be8e561e7eee0d2e25785f30392c77","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ESXi VM Kill Via ESXCLI\nid: 2992ac4d-31e9-4325-99f2-b18a73221bb2\nstatus: test\ndescription: Detects execution of the \"esxcli\" command with the \"vm\" and \"kill\" flag in order to kill/shutdown a specific VM.\nreferences:\n    - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/\n    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html\n    - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/\n    - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html\nauthor: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon\ndate: 2023-09-04\ntags:\n    - attack.execution\n    - attack.impact\n    - attack.t1059.012\n    - attack.t1529\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/esxcli'\n        CommandLine|contains|all:\n            - 'vm process'\n            - 'kill'\n    condition: selection\nfalsepositives:\n    - Legitimate administration activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.012","id":"T1059.012","name":"Hypervisor CLI","page":"techniques/enterprise/T1059.012/"},{"key":"enterprise/T1529","id":"T1529","name":"System Shutdown/Reboot","page":"techniques/enterprise/T1529/"}],"data_path":"data/detection-rules/2992ac4d-31e9-4325-99f2-b18a73221bb2.json","kind":"sigma"}