Detect Hypervisor CLI in Microsoft Sentinel
Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs enable functionality for managing both the hypervisor and guest virtual machines. On ESXi systems, tools such as esxcli and vim-cmd allow administrators to configure firewall rules, manage log forwarding, list/start/stop virtual machines, and more. Adversaries leverage these tools for discovery, VM termination (ransomware), firewall manipulation, and persistence. UNC3886 used esxcli extensively for malware installation and artifact removal. Ransomware families including Cheerscrypt, Royal, and BlackBasta use esxcli to enumerate and terminate VMs before encryption.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.012 Hypervisor CLI
- Canonical reference
- https://attack.mitre.org/techniques/T1059/012/
KQL Detection Query
let SuspiciousCommands = dynamic([
"esxcli vm process kill", "esxcli vm process list",
"vim-cmd vmsvc/power.off", "vim-cmd vmsvc/getallvms",
"esxcli system maintenanceMode",
"esxcli network firewall", "esxcli network ip",
"esxcli software vib install", "esxcli software vib remove",
"esxcli software acceptance set",
"esxcli system syslog", "esxcli system settings advanced",
"vim-cmd hostsvc/enable_ssh", "vim-cmd hostsvc/start_ssh",
"vim-cmd solo/registervm",
"/sbin/esxcli", "/bin/vim-cmd",
"chmod +x", "nohup",
".vmdk", ".vmx", ".vmsd", ".vmsn"
]);
Syslog
| where TimeGenerated > ago(24h)
| where Computer has_any ("esx", "vmware") or ProcessName has_any ("esxcli", "vim-cmd", "hostd", "vpxa")
| where SyslogMessage has_any (SuspiciousCommands)
| extend VMKill = SyslogMessage has_any ("vm process kill", "power.off")
| extend VIBInstall = SyslogMessage has "vib install"
| extend FirewallChange = SyslogMessage has "network firewall"
| extend SSHEnable = SyslogMessage has_any ("enable_ssh", "start_ssh")
| extend SyslogModify = SyslogMessage has "system syslog"
| project TimeGenerated, Computer, ProcessName, SyslogMessage,
VMKill, VIBInstall, FirewallChange, SSHEnable, SyslogModify
| sort by TimeGenerated descDetects suspicious ESXi hypervisor CLI commands from syslog data in Microsoft Sentinel. Monitors esxcli and vim-cmd usage for VM termination (ransomware indicator), VIB installation (persistence/backdoor), firewall rule changes, SSH enablement, and syslog manipulation. Covers activity by UNC3886, Cheerscrypt, Royal, and other ESXi-targeting threats.
Data Sources
Required Tables
False Positives & Tuning
- VMware administrators performing routine VM management (start/stop VMs during maintenance)
- Patching operations installing legitimate VIBs during scheduled maintenance windows
- Infrastructure automation tools (vRealize, Ansible) managing ESXi hosts
Other platforms for T1059.012
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1ESXi VM Enumeration Simulation
Expected signal: Syslog message with facility local7 containing 'esxcli vm process list'. This validates that ESXi-format syslog messages are being ingested by the SIEM.
- Test 2ESXi VIB Installation Simulation
Expected signal: Syslog message with facility local7 containing 'vib install' and '--no-sig-check'. The --no-sig-check flag bypasses signature verification.
- Test 3ESXi VM Kill Simulation
Expected signal: Syslog message with facility local7 containing 'vm process kill --type=force'. The force kill type is used by ransomware to immediately terminate VMs.
References (6)
- https://attack.mitre.org/techniques/T1059/012/
- https://developer.broadcom.com/xapis/esxcli-command-reference/latest/
- https://lolesxi-project.github.io/LOLESXi/
- https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
- https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence
- https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html
Unlock Pro Content
Get the full detection package for T1059.012 including response playbook, investigation guide, and atomic red team tests.