Detect Hypervisor CLI in Sumo Logic CSE
Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs enable functionality for managing both the hypervisor and guest virtual machines. On ESXi systems, tools such as esxcli and vim-cmd allow administrators to configure firewall rules, manage log forwarding, list/start/stop virtual machines, and more. Adversaries leverage these tools for discovery, VM termination (ransomware), firewall manipulation, and persistence. UNC3886 used esxcli extensively for malware installation and artifact removal. Ransomware families including Cheerscrypt, Royal, and BlackBasta use esxcli to enumerate and terminate VMs before encryption.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.012 Hypervisor CLI
- Canonical reference
- https://attack.mitre.org/techniques/T1059/012/
Sumo Detection Query
(_sourceCategory="vmware" OR _sourceCategory="esxi" OR _sourceCategory="linux/syslog")
("esxcli" OR "vim-cmd" OR "esxcfg-")
| parse regex "(?<process_name>esxcli|vim-cmd|esxcfg-\S+)" nodrop
| parse regex "(?<full_command>(?:esxcli|vim-cmd|/sbin/esxcli|/bin/vim-cmd)[^\n]+)" nodrop
| eval vm_kill = if(matches(full_command, ".*?(vm process kill|vmsvc/power\.off).*?"), 1, 0)
| eval vm_list = if(matches(full_command, ".*?(vm process list|vmsvc/getallvms).*?"), 1, 0)
| eval vib_install = if(matches(full_command, ".*?(vib install|vib remove|acceptance set).*?"), 1, 0)
| eval firewall_change = if(matches(full_command, ".*?network firewall.*?"), 1, 0)
| eval ssh_enable = if(matches(full_command, ".*?(enable_ssh|start_ssh).*?"), 1, 0)
| eval syslog_modify = if(matches(full_command, ".*?system syslog.*?"), 1, 0)
| eval maintenance_mode = if(matches(full_command, ".*?system maintenanceMode.*?"), 1, 0)
| eval file_staging = if(matches(full_command, ".*?(\.vmdk|\.vmx|\.vmsd|\.vmsn|chmod \+x|nohup ).*?"), 1, 0)
| eval suspicion_score = (vm_kill * 3) + (vib_install * 3) + (firewall_change * 2) + (ssh_enable * 2) + (syslog_modify * 2) + (maintenance_mode * 2) + vm_list + file_staging
| where suspicion_score > 0
| fields _messageTime, _sourceHost, process_name, full_command, vm_kill, vib_install, firewall_change, ssh_enable, syslog_modify, maintenance_mode, file_staging, suspicion_score
| sort by suspicion_score desc, _messageTime descDetects malicious ESXi hypervisor CLI invocations targeting VM termination, VIB package manipulation, firewall rule changes, SSH backdooring, syslog tampering, and VM file staging. Weighted scoring model prioritizes ransomware indicators and persistence techniques over benign enumeration.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled maintenance scripts using esxcli for routine health checks, log rotation configuration, and VIB update workflows executed during approved change windows
- VMware Site Recovery Manager or third-party DR solutions invoking vim-cmd vmsvc/power.off commands during planned failover testing
- ESXi host profile enforcement tools that periodically apply and validate firewall rules and syslog forwarding settings via esxcli network and system commands
Other platforms for T1059.012
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1ESXi VM Enumeration Simulation
Expected signal: Syslog message with facility local7 containing 'esxcli vm process list'. This validates that ESXi-format syslog messages are being ingested by the SIEM.
- Test 2ESXi VIB Installation Simulation
Expected signal: Syslog message with facility local7 containing 'vib install' and '--no-sig-check'. The --no-sig-check flag bypasses signature verification.
- Test 3ESXi VM Kill Simulation
Expected signal: Syslog message with facility local7 containing 'vm process kill --type=force'. The force kill type is used by ransomware to immediately terminate VMs.
References (6)
- https://attack.mitre.org/techniques/T1059/012/
- https://developer.broadcom.com/xapis/esxcli-command-reference/latest/
- https://lolesxi-project.github.io/LOLESXi/
- https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
- https://www.mandiant.com/resources/blog/esxi-hypervisors-malware-persistence
- https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html
Unlock Pro Content
Get the full detection package for T1059.012 including response playbook, investigation guide, and atomic red team tests.