{"id":"33e814e0-1f00-4e43-9c34-31fb7ae2b174","title":"ESXi Network Configuration Discovery Via ESXCLI","description":"Detects execution of the \"esxcli\" command with the \"network\" flag in order to retrieve information about the network configuration.","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":"","tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"technique_ids":["T1007","T1033","T1059.012"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate administration activities"],"references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_network.html"],"source_path":"rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml","source_sha256":"7da173882955e49d65c10155dad31e599c7a66aa878b2c73c9031a3f5b3659bc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ESXi Network Configuration Discovery Via ESXCLI\nid: 33e814e0-1f00-4e43-9c34-31fb7ae2b174\nstatus: test\ndescription: Detects execution of the \"esxcli\" command with the \"network\" flag in order to retrieve information about the network configuration.\nreferences:\n    - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/\n    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_network.html\nauthor: Cedric Maurugeon\ndate: 2023-09-04\ntags:\n    - attack.discovery\n    - attack.execution\n    - attack.t1033\n    - attack.t1007\n    - attack.t1059.012\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_img:\n        Image|endswith: '/esxcli'\n        CommandLine|contains: 'network'\n    selection_cli:\n        CommandLine|contains:\n            - ' get'\n            - ' list'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate administration activities\n# Note: level can be reduced to low in some envs\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1007","id":"T1007","name":"System Service Discovery","page":"techniques/enterprise/T1007/"},{"key":"enterprise/T1033","id":"T1033","name":"System Owner/User Discovery","page":"techniques/enterprise/T1033/"},{"key":"enterprise/T1059.012","id":"T1059.012","name":"Hypervisor CLI","page":"techniques/enterprise/T1059.012/"}],"data_path":"data/detection-rules/33e814e0-1f00-4e43-9c34-31fb7ae2b174.json","kind":"sigma"}