Detect vSphere Installation Bundles in Sumo Logic CSE
Adversaries abuse VMware vSphere Installation Bundles (VIBs) to achieve persistent access on ESXi hypervisors. VIBs are software packages that persist across reboots by being incorporated into the ESXi boot image. Malicious VIBs can deploy backdoors, custom firewall rules, and startup scripts. UNC3886 used malicious VIBs to install VIRTUALPIE backdoor on ESXi. VIBs can be installed with --force flag to bypass acceptance level requirements, and adversaries masquerade them as PartnerSupported by modifying the XML descriptor. ESXi detection is challenging due to limited logging.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1505 Server Software Component
- Sub-technique
- T1505.006 vSphere Installation Bundles
- Canonical reference
- https://attack.mitre.org/techniques/T1505/006/
Sumo Detection Query
// Part 1: Windows Sysmon process events — VIB CLI and PowerCLI
(_sourceCategory="windows/sysmon" OR _sourceCategory="os/windows/sysmon")
| where EventID = 1
| parse "<Image><![CDATA[*]]></Image>" as process_image nodrop
| parse "<CommandLine><![CDATA[*]]></CommandLine>" as command_line nodrop
| parse "<User><![CDATA[*]]></User>" as user nodrop
| parse "<Computer>*</Computer>" as host nodrop
| where (
matches(process_image, "(?i).*(esxcli|esxcfg-dumppart|powercli|vmwarecli)\.exe.*")
OR matches(command_line, "(?i).*(software\s+vib\s+install|--vibs|esxcli\s+software).*")
OR (
matches(process_image, "(?i).*(powershell|pwsh)\.exe.*")
AND matches(command_line, "(?i).*(Install-EsxSoftwarePackage|Add-EsxSoftwareDepot|Get-EsxSoftwarePackage|esxcli\.software\.vib|esxupdate).*")
AND matches(command_line, "(?i).*(vib|esxi|vmware|vsphere).*")
)
)
| if (matches(process_image, "(?i).*(esxcli|esxcfg-dumppart|powercli|vmwarecli)\.exe.*"), "VIB_CLI_Install_Command",
if (matches(command_line, "(?i).*(Install-EsxSoftwarePackage|Add-EsxSoftwareDepot|esxcli\.software\.vib).*"), "VIB_PowerCLI_Management", "VIB_Generic")) as detection_type
| fields _messageTime, host, user, process_image, command_line, detection_type
// Part 2: Sysmon file create events for .vib/.vgz drops
// (_sourceCategory="windows/sysmon" OR _sourceCategory="os/windows/sysmon")
// | where EventID = 11
// | parse "<TargetFilename><![CDATA[*]]></TargetFilename>" as target_file nodrop
// | where matches(target_file, "(?i).*\.(vib|vgz)$")
// | "VIB_File_Drop" as detection_type
// Part 3: ESXi/Linux syslog VIB install via shell
// (_sourceCategory="os/linux" OR _sourceCategory="vmware/esxi")
// | where matches(_raw, "(?i).*(software\s+vib\s+install|esxcli.*vib.*install|--force.*vib).*")
// | "ESXi_VIB_Syslog_Install" as detection_type
| count by detection_type, host, user, process_image
| sort by _count descSumo Logic query detecting ESXi VIB installation activity on Windows management hosts via Sysmon process creation events. Identifies esxcli/PowerCLI binary execution and PowerShell commands invoking VMware VIB management cmdlets. Companion queries (commented) extend coverage to Sysmon file creation events for .vib/.vgz drops and direct ESXi syslog forwarding.
Data Sources
Required Tables
False Positives & Tuning
- VMware Lifecycle Manager (vLCM) and vCenter Update Manager executing esxcli commands as part of automated ESXi patching workflows
- Infrastructure automation tools like Ansible with community.vmware collection using PowerCLI cmdlets for configuration management
- Security teams conducting authorized red team exercises or VIB-based persistence testing against non-production ESXi environments
Other platforms for T1505.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1List Installed VIBs on ESXi Host
Expected signal: ESXi shell audit log: esxcli command execution. If ESXi syslog is forwarded: syslog entry for esxcli invocation.
- Test 2Check ESXi VIB Acceptance Level
Expected signal: ESXi shell audit log for esxcli execution.
- Test 3Simulate VIB Install CLI Command on Windows Management Host
Expected signal: Sysmon EventCode 1: powershell.exe with CommandLine containing 'vib install' and '--force'.
References (4)
Unlock Pro Content
Get the full detection package for T1505.006 including response playbook, investigation guide, and atomic red team tests.