{"id":"5f1573a7-363b-4114-9208-ad7a61de46eb","title":"ESXi VM List Discovery Via ESXCLI","description":"Detects execution of the \"esxcli\" command with the \"vm\" flag in order to retrieve information about the installed VMs.","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":"","tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"technique_ids":["T1007","T1033","T1059.012"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate administration activities"],"references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html","https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/","https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"],"source_path":"rules/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml","source_sha256":"f67cdcb6670752cdfc18cf1c4639def409fdefd344b36d82ecea0a391b27d617","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ESXi VM List Discovery Via ESXCLI\nid: 5f1573a7-363b-4114-9208-ad7a61de46eb\nstatus: test\ndescription: Detects execution of the \"esxcli\" command with the \"vm\" flag in order to retrieve information about the installed VMs.\nreferences:\n    - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/\n    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html\n    - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/\n    - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html\nauthor: Cedric Maurugeon\ndate: 2023-09-04\ntags:\n    - attack.discovery\n    - attack.execution\n    - attack.t1033\n    - attack.t1007\n    - attack.t1059.012\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/esxcli'\n        CommandLine|contains: 'vm process'\n        CommandLine|endswith: ' list'\n    condition: selection\nfalsepositives:\n    - Legitimate administration activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1007","id":"T1007","name":"System Service Discovery","page":"techniques/enterprise/T1007/"},{"key":"enterprise/T1033","id":"T1033","name":"System Owner/User Discovery","page":"techniques/enterprise/T1033/"},{"key":"enterprise/T1059.012","id":"T1059.012","name":"Hypervisor CLI","page":"techniques/enterprise/T1059.012/"}],"data_path":"data/detection-rules/5f1573a7-363b-4114-9208-ad7a61de46eb.json","kind":"sigma"}