{"id":"d54c2f06-aca9-4e2b-81c9-5317858f4b79","title":"ESXi VSAN Information Discovery Via ESXCLI","description":"Detects execution of the \"esxcli\" command with the \"vsan\" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":"","tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"technique_ids":["T1007","T1033","T1059.012"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate administration activities"],"references":["https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html","https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html"],"source_path":"rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml","source_sha256":"2ad83ae8c6fb2818634c1be778177b2112d6a1d71528e2afc6aa3dfd1e122804","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ESXi VSAN Information Discovery Via ESXCLI\nid: d54c2f06-aca9-4e2b-81c9-5317858f4b79\nstatus: test\ndescription: Detects execution of the \"esxcli\" command with the \"vsan\" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.\nreferences:\n    - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html\n    - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html\n    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html\nauthor: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon\ndate: 2023-09-04\ntags:\n    - attack.discovery\n    - attack.execution\n    - attack.t1033\n    - attack.t1007\n    - attack.t1059.012\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_img:\n        Image|endswith: '/esxcli'\n        CommandLine|contains: 'vsan'\n    selection_cli:\n        CommandLine|contains:\n            - ' get'\n            - ' list'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate administration activities\n# Note: level can be reduced to low in some envs\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1007","id":"T1007","name":"System Service Discovery","page":"techniques/enterprise/T1007/"},{"key":"enterprise/T1033","id":"T1033","name":"System Owner/User Discovery","page":"techniques/enterprise/T1033/"},{"key":"enterprise/T1059.012","id":"T1059.012","name":"Hypervisor CLI","page":"techniques/enterprise/T1059.012/"}],"data_path":"data/detection-rules/d54c2f06-aca9-4e2b-81c9-5317858f4b79.json","kind":"sigma"}