Windows Process Creation: net.exe or PowerShell Creates "ESX Admins" Domain Group

title: 'Windows Process Creation: net.exe or PowerShell Creates "ESX Admins" Domain Group'
id: 4cb132b4-c5cb-4d2e-ba6a-54ee85259d3a
status: test
description: This rule flags Windows process activity where net.exe (net.exe or net1.exe) or PowerShell (PowerShell.exe/pwsh) attempts to create a domain group named "ESX Admins". Adding that specific group is significant because domain group membership of "ESX Admins" is treated as full administrative access by default for domain-joined ESXi hypervisors. The detection relies on process creation telemetry, matching the executable path/name and required command-line parameters including group name and domain/group options.
references:
  - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-37085/proc_creation_win_exploit_cve_2024_37085_esxi_admins_group_creation.yml
author: frack113, Huntrule Team
date: 2024-07-29
tags:
  - attack.execution
  - cve.2024-37085
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_net_img:
    - Image|endswith:
        - \net.exe
        - \net1.exe
    - OriginalFileName:
        - net.exe
        - net1.exe
  selection_net_cmd:
    CommandLine|contains|all:
      - /add
      - /domain
      - ESX Admins
      - group
  selection_powershell_img:
    - Image|endswith:
        - \PowerShell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.exe
        - pwsh.dll
  selection_powershell_cli:
    CommandLine|contains|all:
      - New-ADGroup
      - ESX Admins
  condition: all of selection_net_* or all of selection_powershell_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c408acfe-2870-41df-8d2f-9f4daa4555ed
    type: derived