Linux Process Creation: ESXi esxcli system discovery via system namespace
Alert on esxcli system invocations using get/list subcommands to discover ESXi system component information.
- Product
- linux
- Category
- process_creation
- Author
- Cedric Maurugeon (SigmaHQ), DRL 1.1
- Published
- 2023-09-04
- Updated
- 2026-07-31
ATT&CK techniques
Execution → DiscoveryRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Linux process creation events where an executable path ends with /esxcli and the command line contains the system flag. It further requires command-line text consistent with esxcli subcommands such as " get" or " list", indicating attempts to retrieve system component information (for example, accounts, modules, or NTP). Such discovery helps attackers enumerate the hypervisor environment before later actions, and the detection relies on process start telemetry including Image and CommandLine.
Reporting behind it
- crowdstrike.comhttps://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
- developer.broadcom.comhttps://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux Process Creation: ESXi esxcli system discovery via system namespace"
id: ad05d9ec-5cff-4502-92ad-0a4ee977f64b
status: test
description: This rule matches Linux process creation events where an executable path ends with /esxcli and the command line contains the system flag. It further requires command-line text consistent with esxcli subcommands such as " get" or " list", indicating attempts to retrieve system component information (for example, accounts, modules, or NTP). Such discovery helps attackers enumerate the hypervisor environment before later actions, and the detection relies on process start telemetry including Image and CommandLine.
references:
- https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml
author: Cedric Maurugeon, Huntrule Team
date: 2023-09-04
tags:
- attack.discovery
- attack.execution
- attack.t1033
- attack.t1007
- attack.t1059.012
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /esxcli
CommandLine|contains: system
selection_cli:
CommandLine|contains:
- " get"
- " list"
condition: all of selection_*
falsepositives:
- Legitimate administration activities
level: medium
license: DRL-1.1
related:
- id: e80273e1-9faf-40bc-bd85-dbaff104c4e9
type: derived