{"id":"f41dada5-3f56-4232-8503-3fb7f9cf2d60","title":"ESXi Storage Information Discovery Via ESXCLI","description":"Detects execution of the \"esxcli\" command with the \"storage\" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":"","tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"technique_ids":["T1007","T1033","T1059.012"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate administration activities"],"references":["https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html","https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html"],"source_path":"rules/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml","source_sha256":"fba45d486c957ceadafafbe4c9088b7419d130755e4bb4a34353eff8b14ecc74","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ESXi Storage Information Discovery Via ESXCLI\nid: f41dada5-3f56-4232-8503-3fb7f9cf2d60\nstatus: test\ndescription: Detects execution of the \"esxcli\" command with the \"storage\" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.\nreferences:\n    - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html\n    - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html\n    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html\nauthor: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon\ndate: 2023-09-04\ntags:\n    - attack.discovery\n    - attack.execution\n    - attack.t1033\n    - attack.t1007\n    - attack.t1059.012\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_img:\n        Image|endswith: '/esxcli'\n        CommandLine|contains: 'storage'\n    selection_cli:\n        CommandLine|contains:\n            - ' get'\n            - ' list'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate administration activities\n# Note: level can be reduced to low in some envs\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1007","id":"T1007","name":"System Service Discovery","page":"techniques/enterprise/T1007/"},{"key":"enterprise/T1033","id":"T1033","name":"System Owner/User Discovery","page":"techniques/enterprise/T1033/"},{"key":"enterprise/T1059.012","id":"T1059.012","name":"Hypervisor CLI","page":"techniques/enterprise/T1059.012/"}],"data_path":"data/detection-rules/f41dada5-3f56-4232-8503-3fb7f9cf2d60.json","kind":"sigma"}