Linux Process Execution: ESXi esxcli Storage Discovery

title: "Linux Process Execution: ESXi esxcli Storage Discovery"
id: f046022c-2ac3-4619-bc95-953123faca83
status: test
description: This rule identifies process executions where an esxcli binary is run and the command line contains the 'storage' flag plus storage-related subcommands (such as 'get' and 'list'). Attackers may use ESXi storage discovery to understand available devices and status before staging or impacting virtual infrastructure. It relies on Linux process creation telemetry, specifically the executable path ending in /esxcli and matching command-line substrings.
references:
  - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html
  - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml
author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule Team
date: 2023-09-04
tags:
  - attack.discovery
  - attack.execution
  - attack.t1033
  - attack.t1007
  - attack.t1059.012
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /esxcli
    CommandLine|contains: storage
  selection_cli:
    CommandLine|contains:
      - " get"
      - " list"
  condition: all of selection_*
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: f41dada5-3f56-4232-8503-3fb7f9cf2d60
    type: derived