Linux ESXi esxcli VSAN Information Discovery via esxcli Command
Flags Linux executions of /esxcli with the vsan namespace and get/list subcommands to enumerate virtual storage.
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon (SigmaHQ), DRL 1.1
- Published
- 2023-09-04
- Updated
- 2026-07-31
ATT&CK techniques
Execution → DiscoveryRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule detects process executions where the command path ends with "esxcli" and the command line includes the "vsan" flag, along with subcommands containing " get" and " list". Attackers may use this to enumerate virtual storage and related VSAN configuration details as part of discovery before further actions. It relies on Linux process creation telemetry capturing the executable path and full command line arguments.
Reporting behind it
- trendmicro.comhttps://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html
- trendmicro.comhttps://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html
- developer.broadcom.comhttps://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux ESXi esxcli VSAN Information Discovery via esxcli Command
id: 8f90b914-47ce-412e-bbf4-5a7dad5cd2bb
status: test
description: This rule detects process executions where the command path ends with "esxcli" and the command line includes the "vsan" flag, along with subcommands containing " get" and " list". Attackers may use this to enumerate virtual storage and related VSAN configuration details as part of discovery before further actions. It relies on Linux process creation telemetry capturing the executable path and full command line arguments.
references:
- https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html
- https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html
- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml
author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule Team
date: 2023-09-04
tags:
- attack.discovery
- attack.execution
- attack.t1033
- attack.t1007
- attack.t1059.012
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /esxcli
CommandLine|contains: vsan
selection_cli:
CommandLine|contains:
- " get"
- " list"
condition: all of selection_*
falsepositives:
- Legitimate administration activities
level: medium
license: DRL-1.1
related:
- id: d54c2f06-aca9-4e2b-81c9-5317858f4b79
type: derived