Windows Process Creation: net.exe or PowerShell creating AD group "ESX Admins"
Alerts on net.exe or PowerShell attempts to create a domain group named "ESX Admins" via AD/command-line parameters.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2024-07-29
- Updated
- 2026-07-31
What it detects
This rule flags Windows process activity where net.exe is executed with parameters to add a domain group named "ESX Admins", or where PowerShell creates a new Active Directory group with the same name. Group names like "ESX Admins" can confer high privileges on domain-joined ESXi hypervisors, so such creation attempts may indicate credentialed privilege escalation or preparation for ESXi administrative access. It relies on process creation telemetry, including the process image/original filename and command-line arguments containing the required flags and group name.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-37085/proc_creation_win_exploit_cve_2024_37085_esxi_admins_group_creation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: 'Windows Process Creation: net.exe or PowerShell creating AD group "ESX Admins"'
id: 4cb132b4-c5cb-4d2e-ba6a-54ee85259d3a
status: test
description: This rule flags Windows process activity where net.exe is executed with parameters to add a domain group named "ESX Admins", or where PowerShell creates a new Active Directory group with the same name. Group names like "ESX Admins" can confer high privileges on domain-joined ESXi hypervisors, so such creation attempts may indicate credentialed privilege escalation or preparation for ESXi administrative access. It relies on process creation telemetry, including the process image/original filename and command-line arguments containing the required flags and group name.
references:
- https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-37085/proc_creation_win_exploit_cve_2024_37085_esxi_admins_group_creation.yml
author: frack113, Huntrule Team
date: 2024-07-29
tags:
- attack.execution
- cve.2024-37085
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_net_img:
- Image|endswith:
- \net.exe
- \net1.exe
- OriginalFileName:
- net.exe
- net1.exe
selection_net_cmd:
CommandLine|contains|all:
- /add
- /domain
- ESX Admins
- group
selection_powershell_img:
- Image|endswith:
- \PowerShell.exe
- \pwsh.exe
- OriginalFileName:
- PowerShell.exe
- pwsh.dll
selection_powershell_cli:
CommandLine|contains|all:
- New-ADGroup
- ESX Admins
condition: all of selection_net_* or all of selection_powershell_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: c408acfe-2870-41df-8d2f-9f4daa4555ed
type: derived