Windows Security: Changes to "ESX Admins" Domain Group Membership
Alerts on domain group management events involving the "ESX Admins" group name, which may grant privileged access.
- Product
- windows
- Service
- security
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-07-30
- Updated
- 2026-07-31
What it detects
This rule alerts on Windows Security events indicating creation, modification, or membership changes involving a domain group named "ESX Admins". Such group changes can grant or expand elevated administrative access in environments where this group name confers privileged permissions, making it a valuable signal for potential exploitation or abuse. It relies on Windows Security audit events 4727, 4728, 4731, 4737, 4754, 4755, and 4756 combined with the presence of the exact group name keyword "ESX Admins".
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-37085/win_security_exploit_cve_2024_37085_esxi_admins_group.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: 'Windows Security: Changes to "ESX Admins" Domain Group Membership'
id: c38b479b-7fc7-446d-ab61-ed756a1840f9
status: test
description: This rule alerts on Windows Security events indicating creation, modification, or membership changes involving a domain group named "ESX Admins". Such group changes can grant or expand elevated administrative access in environments where this group name confers privileged permissions, making it a valuable signal for potential exploitation or abuse. It relies on Windows Security audit events 4727, 4728, 4731, 4737, 4754, 4755, and 4756 combined with the presence of the exact group name keyword "ESX Admins".
references:
- https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-37085/win_security_exploit_cve_2024_37085_esxi_admins_group.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-30
tags:
- attack.execution
- cve.2024-37085
- detection.emerging-threats
logsource:
product: windows
service: security
detection:
selection:
EventID:
- 4727
- 4728
- 4731
- 4737
- 4754
- 4755
- 4756
keyword_group:
- ESX Admins
condition: selection and keyword_group
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 47a1658b-67a4-48e2-8ab1-c10437fc0148
type: derived