Possible ESXi Storage Information Enumeration Through ESXCLI (via process_creation)

title: Possible ESXi Storage Information Enumeration Through ESXCLI (via process_creation)
id: a4250bf7-4439-5db0-be32-bc2b95060a7e
status: stable
description: This rule detects execution of the "esxcli" command with the "storage" flag to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.
references:
    - https://attack.mitre.org/techniques/T1059/012/
    - https://attack.mitre.org/techniques/T1007/
    - https://attack.mitre.org/techniques/T1033/
    - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html
    - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html
    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html
author: Huntrule Team
date: 2026-06-10
tags:
    - attack.discovery
    - attack.execution
    - attack.t1033
    - attack.t1007
    - attack.t1059.012
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        Image|endswith: '/esxcli'
        CommandLine|contains: 'storage'
    selection_cli:
        CommandLine|contains:
            - ' get'
            - ' list'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium