Detect vSphere Installation Bundles in Microsoft Sentinel
Adversaries abuse VMware vSphere Installation Bundles (VIBs) to achieve persistent access on ESXi hypervisors. VIBs are software packages that persist across reboots by being incorporated into the ESXi boot image. Malicious VIBs can deploy backdoors, custom firewall rules, and startup scripts. UNC3886 used malicious VIBs to install VIRTUALPIE backdoor on ESXi. VIBs can be installed with --force flag to bypass acceptance level requirements, and adversaries masquerade them as PartnerSupported by modifying the XML descriptor. ESXi detection is challenging due to limited logging.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1505 Server Software Component
- Sub-technique
- T1505.006 vSphere Installation Bundles
- Canonical reference
- https://attack.mitre.org/techniques/T1505/006/
KQL Detection Query
// T1505.006 — vSphere Installation Bundle (VIB) detection
// ESXi is not typically covered by MDE; this query targets vCenter management events
// Part 1: Detect esxcli or vSphere CLI commands for VIB installation from Windows management hosts
let VIBInstallCLI = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("esxcli.exe", "esxcfg-dumppart.exe", "vicfg-nics.pl",
"powercli.exe", "vmwarecli.exe")
or ProcessCommandLine has_any ("software vib install", "vib install", "--vibs",
"software vib list", "esxcli software")
| extend DetectionType = "VIB_Install_CLI_Command"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Part 2: Detect PowerCLI commands for VIB management from Windows hosts
let VIBPowerCLI = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("Install-EsxSoftwarePackage", "Add-EsxSoftwareDepot",
"Get-EsxSoftwarePackage", "software vib",
"esxcli.software.vib", "--force", "esxupdate")
and ProcessCommandLine has_any ("vib", "esxi", "vmware", "vsphere")
| extend DetectionType = "VIB_PowerCLI_Management"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Part 3: Detect .vib or .zip files that could be VIB packages written to disk
let VIBFileDrop = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FileName endswith ".vib" or FileName endswith ".vgz"
| extend DetectionType = "VIB_File_Created"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
union VIBInstallCLI, VIBPowerCLI, VIBFileDrop
| sort by Timestamp descThree-part detection for vSphere VIB persistence from Windows management hosts. Part 1 detects esxcli and VMware CLI tools executing VIB install commands. Part 2 catches PowerCLI cmdlets for VIB package management (Install-EsxSoftwarePackage, Add-EsxSoftwareDepot). Part 3 monitors for .vib and .vgz file creation on management hosts before transfer to ESXi. Note: direct ESXi shell monitoring requires syslog forwarding from the hypervisor.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate VMware administrator deploying authorized VIBs for driver updates or vSAN components
- VMware Update Manager (VUM) performing scheduled ESXi patch deployments
- VMware Tools upgrades that deploy VIB packages to ESXi hosts
- Authorized network adapter or storage driver VIBs installed by infrastructure team
Other platforms for T1505.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1List Installed VIBs on ESXi Host
Expected signal: ESXi shell audit log: esxcli command execution. If ESXi syslog is forwarded: syslog entry for esxcli invocation.
- Test 2Check ESXi VIB Acceptance Level
Expected signal: ESXi shell audit log for esxcli execution.
- Test 3Simulate VIB Install CLI Command on Windows Management Host
Expected signal: Sysmon EventCode 1: powershell.exe with CommandLine containing 'vib install' and '--force'.
References (4)
Unlock Pro Content
Get the full detection package for T1505.006 including response playbook, investigation guide, and atomic red team tests.