Linux Process Execution: ESXi esxcli Network Discovery Commands

title: "Linux Process Execution: ESXi esxcli Network Discovery Commands"
id: 8122da54-af19-450c-b1fb-6a364c572126
status: test
description: This rule flags Linux process executions where an ESXi-related "esxcli" binary is invoked and the command line includes the "network" flag. It further requires command-line terms consistent with querying or enumerating network information (e.g., "get" or "list"). Attackers and admins can use this to enumerate ESXi network configuration during discovery, making it a useful signal when correlated with other activity. The detection relies on process creation telemetry, specifically the executable path and full command line.
references:
  - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_network.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml
author: Cedric Maurugeon, Huntrule Team
date: 2023-09-04
tags:
  - attack.discovery
  - attack.execution
  - attack.t1033
  - attack.t1007
  - attack.t1059.012
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /esxcli
    CommandLine|contains: network
  selection_cli:
    CommandLine|contains:
      - " get"
      - " list"
  condition: all of selection_*
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 33e814e0-1f00-4e43-9c34-31fb7ae2b174
    type: derived