Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
30 detections
Filters
Last updated
All Time
Detection languages
20
6
2
2
Contributors
18
7
2
1
1
Categories
16
14
10
6
3
Platforms
21
14
5
Products / Services
11
3
2
2
2
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
IDS Classtypes
2
IDS Protocols
2
Detects the execution of the "esxcli" command with the "vsan" flag to gather information about virtual storage on VMware ESXi systems. This activity has been observed in malware campaigns, including DarkSide and LockBit ransomware, indicating potential reconnaissance or preparation for impact on virtualized environments.
Detects changes to the ESXi syslog configuration via the 'esxcli' command-line utility. This activity could indicate an adversary attempting to impair defenses by modifying logging configurations on an ESXi hypervisor.
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.
Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.
Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.
Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.
Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.
Detects user account creation on ESXi system via esxcli
Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.
Page 2 of 2