ESXi System Information Discovery Via ESXCLI

Status: test
Severity: medium
Log source: category process_creation, product linux
Author: Cedric Maurugeon
Source: github.com/SigmaHQ/sigma

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

Known false positives

Legitimate administration activities

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.012` Command and Scripting Interpreter: Hypervisor CLI
Discovery	`T1007` System Service Discovery `T1033` System Owner/User Discovery

Telemetry coverage

Platform	Record / event type
Linux	Event ID 1: Process Create

Rule body

title: ESXi System Information Discovery Via ESXCLI
id: e80273e1-9faf-40bc-bd85-dbaff104c4e9
status: test
description: Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.
references:
    - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
author: Cedric Maurugeon
date: 2023-09-04
tags:
    - attack.discovery
    - attack.execution
    - attack.t1033
    - attack.t1007
    - attack.t1059.012
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        Image|endswith: '/esxcli'
        CommandLine|contains: 'system'
    selection_cli:
        CommandLine|contains:
            - ' get'
            - ' list'
    condition: all of selection_*
falsepositives:
    - Legitimate administration activities
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    Image|endswith: '/esxcli'
    CommandLine|contains: 'system'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains:
        - ' get'
        - ' list'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`get` `list` `system`	`field:"CommandLine" kind:match`
`Image`	ends_with	`/esxcli`	`field:"Image" kind:ends_with value:"/esxcli"`