Linux Process Execution: esxcli vm kill/shutdown a VM on ESXi

title: "Linux Process Execution: esxcli vm kill/shutdown a VM on ESXi"
id: 0491e5fc-7166-4a7d-8bc1-51372026c8b4
status: test
description: This rule flags process creation where the executable path ends with /esxcli and the command line includes both 'vm process' and 'kill'. Attackers and administrators may use esxcli to terminate or shut down virtual machines, which can disrupt availability or support further impact. The detection relies on Linux process creation telemetry capturing the executed binary path and the full command line arguments.
references:
  - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html
  - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/
  - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml
author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule Team
date: 2023-09-04
tags:
  - attack.execution
  - attack.impact
  - attack.t1059.012
  - attack.t1529
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /esxcli
    CommandLine|contains|all:
      - vm process
      - kill
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 2992ac4d-31e9-4325-99f2-b18a73221bb2
    type: derived