Linux Process Execution: ESXi esxcli system Discovery Commands

title: "Linux Process Execution: ESXi esxcli system Discovery Commands"
id: ad05d9ec-5cff-4502-92ad-0a4ee977f64b
status: test
description: This rule flags Linux process executions where the command image ends with /esxcli and the command line contains the system flag, along with get/list subcommands. Attackers may use esxcli system queries to enumerate ESXi component information such as accounts, modules, and NTP settings. It relies on process creation telemetry capturing the executable path and the full command line arguments.
references:
  - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml
author: Cedric Maurugeon, Huntrule Team
date: 2023-09-04
tags:
  - attack.discovery
  - attack.execution
  - attack.t1033
  - attack.t1007
  - attack.t1059.012
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /esxcli
    CommandLine|contains: system
  selection_cli:
    CommandLine|contains:
      - " get"
      - " list"
  condition: all of selection_*
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: e80273e1-9faf-40bc-bd85-dbaff104c4e9
    type: derived