Service Stop — ESXi Hypervisor Ransomware — Mass VM Termination and Datastore Encryption

// THREAT-ESXi-HypervisorRansomware (T1489 Service Stop -> T1486 Data Encrypted for Impact)
// Requires ESXi/vCenter syslog forwarded to the Syslog table (Azure Monitor Agent Linux syslog collection)
let ESXiHosts = dynamic(["<YOUR_ESXI_HOST_FQDNS_OR_IPS>"]); // populate from vCenter inventory; leave empty to match on ProcessName instead
let Lookback = 1h;
// Signal 1: SSH enabled/used on ESXi shortly before mass VM kill activity
let SSHActivity = Syslog
| where TimeGenerated > ago(Lookback)
| where ProcessName has_any ("sshd", "hostd")
| where SyslogMessage has_any ("Accepted password", "Accepted publickey", "TSM-SSH", "SSH login enabled")
| project TimeGenerated, Computer, SyslogMessage, Indicator = "SSHEnabledOrUsed";
// Signal 2: burst of forced VM kills / power-off commands on a single host
let VMKillBurst = Syslog
| where TimeGenerated > ago(Lookback)
| where (isempty(ESXiHosts) or Computer in (ESXiHosts))
| where SyslogMessage has_any ("esxcli vm process kill", "vim-cmd vmsvc/power.off", "vim-cmd vmsvc/power.shutdown")
| extend WorldOrVmId = extract(@"(world-id|--world-id)[= ]([0-9]+)", 2, SyslogMessage)
| summarize KillCount = count(), DistinctTargets = dcount(WorldOrVmId), SampleCommands = make_set(SyslogMessage, 10) by Computer, bin(TimeGenerated, 10m)
| where KillCount >= 5 or DistinctTargets >= 5
| project TimeGenerated, Computer, SyslogMessage = strcat_array(SampleCommands, " | "), Indicator = "MassVMKill";
// Signal 3: bulk datastore file rename/delete of VM disk files in the same window (encryption/corruption in progress)
let DatastoreBulkOps = Syslog
| where TimeGenerated > ago(Lookback)
| where ProcessName has "hostd"
| where SyslogMessage has_any (".vmdk", ".vmx", ".vmsd", ".vswp")
| where SyslogMessage has_any ("Rename", "rm -f", "unlink", "delete")
| summarize FileOpCount = count(), SampleFiles = make_set(SyslogMessage, 10) by Computer, bin(TimeGenerated, 10m)
| where FileOpCount >= 20
| project TimeGenerated, Computer, SyslogMessage = strcat_array(SampleFiles, " | "), Indicator = "BulkDatastoreFileOps";
union SSHActivity, VMKillBurst, DatastoreBulkOps
| sort by TimeGenerated desc

index=esxi sourcetype=syslog
(
  (CommandLine="*Accepted password*" OR CommandLine="*Accepted publickey*" OR _raw="*TSM-SSH*")
  OR (_raw="*esxcli vm process kill*" OR _raw="*vim-cmd vmsvc/power.off*" OR _raw="*vim-cmd vmsvc/power.shutdown*")
  OR (
    (_raw="*.vmdk*" OR _raw="*.vmx*" OR _raw="*.vmsd*" OR _raw="*.vswp*")
    AND (_raw="*Rename*" OR _raw="*rm -f*" OR _raw="*unlink*" OR _raw="*delete*")
  )
)
| eval Indicator=case(
    match(_raw, "(?i)(accepted password|accepted publickey|tsm-ssh)"), "SSHEnabledOrUsed",
    match(_raw, "(?i)(esxcli vm process kill|vim-cmd vmsvc/power)"), "VMKillCommand",
    true(), "DatastoreFileOp"
  )
| bin _time span=10m
| stats count as EventCount, values(_raw) as SampleEvents, dc(host) as HostCount by host, _time, Indicator
| where (Indicator="VMKillCommand" AND EventCount>=5) OR (Indicator="DatastoreFileOp" AND EventCount>=20) OR Indicator="SSHEnabledOrUsed"
| sort - _time

any where event.dataset == "system.syslog" and (
  message : ("*Accepted password*", "*Accepted publickey*", "*TSM-SSH*") or
  message : ("*esxcli vm process kill*", "*vim-cmd vmsvc/power.off*", "*vim-cmd vmsvc/power.shutdown*") or
  (
    message : ("*.vmdk*", "*.vmx*", "*.vmsd*", "*.vswp*") and
    message : ("*Rename*", "*rm -f*", "*unlink*", "*delete*")
  )
)

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS HostIP,
  UTF8(payload) AS RawMessage,
  CASE
    WHEN LOWER(UTF8(payload)) LIKE '%accepted password%' OR LOWER(UTF8(payload)) LIKE '%accepted publickey%' OR LOWER(UTF8(payload)) LIKE '%tsm-ssh%' THEN 'SSHEnabledOrUsed'
    WHEN LOWER(UTF8(payload)) LIKE '%esxcli vm process kill%' OR LOWER(UTF8(payload)) LIKE '%vim-cmd vmsvc/power%' THEN 'VMKillCommand'
    WHEN (LOWER(UTF8(payload)) LIKE '%.vmdk%' OR LOWER(UTF8(payload)) LIKE '%.vmx%' OR LOWER(UTF8(payload)) LIKE '%.vmsd%')
      AND (LOWER(UTF8(payload)) LIKE '%rename%' OR LOWER(UTF8(payload)) LIKE '%rm -f%' OR LOWER(UTF8(payload)) LIKE '%unlink%' OR LOWER(UTF8(payload)) LIKE '%delete%')
      THEN 'DatastoreFileOp'
    ELSE 'Other'
  END AS Indicator
FROM events
WHERE
  (
    LOWER(UTF8(payload)) LIKE '%accepted password%'
    OR LOWER(UTF8(payload)) LIKE '%accepted publickey%'
    OR LOWER(UTF8(payload)) LIKE '%tsm-ssh%'
    OR LOWER(UTF8(payload)) LIKE '%esxcli vm process kill%'
    OR LOWER(UTF8(payload)) LIKE '%vim-cmd vmsvc/power%'
    OR (
      (LOWER(UTF8(payload)) LIKE '%.vmdk%' OR LOWER(UTF8(payload)) LIKE '%.vmx%' OR LOWER(UTF8(payload)) LIKE '%.vmsd%')
      AND (LOWER(UTF8(payload)) LIKE '%rename%' OR LOWER(UTF8(payload)) LIKE '%delete%')
    )
  )
ORDER BY devicetime DESC
LAST 24 HOURS

_sourceCategory=*esxi* or _sourceCategory=*vmware* or _sourceCategory=*syslog*
| where _raw matches "(?i).*(accepted password|accepted publickey|tsm-ssh).*"
    or _raw matches "(?i).*(esxcli vm process kill|vim-cmd vmsvc/power).*"
    or (_raw matches "(?i).*(\\.vmdk|\\.vmx|\\.vmsd|\\.vswp).*" and _raw matches "(?i).*(rename|rm -f|unlink|delete).*")
| eval Indicator = if(_raw matches "(?i).*(accepted password|accepted publickey|tsm-ssh).*", "SSHEnabledOrUsed",
    if(_raw matches "(?i).*(esxcli vm process kill|vim-cmd vmsvc/power).*", "VMKillCommand", "DatastoreFileOp"))
| timeslice 10m
| stats count as EventCount, values(_raw) as SampleEvents by _sourceHost, _timeslice, Indicator
| where (Indicator="VMKillCommand" and EventCount>=5) or (Indicator="DatastoreFileOp" and EventCount>=20) or Indicator="SSHEnabledOrUsed"
| sort by EventCount desc

rule esxi_hypervisor_ransomware {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects ESXi hypervisor ransomware precursor activity: SSH enablement/use, mass VM kill commands, and bulk datastore file operations"
    reference = "https://attack.mitre.org/techniques/T1489/"
    severity = "CRITICAL"
    priority = "HIGH"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1489, T1486"
    false_positives = "Planned maintenance, DR tests, backup software quiescing, Storage vMotion"
    version = "1.0"

  events:
    $e.metadata.event_type = "GENERIC_EVENT"
    (
      re.regex($e.metadata.description, `(?i)(accepted password|accepted publickey|tsm-ssh)`) or
      re.regex($e.metadata.description, `(?i)(esxcli vm process kill|vim-cmd vmsvc/power)`) or
      (
        re.regex($e.metadata.description, `(?i)(\.vmdk|\.vmx|\.vmsd|\.vswp)`) and
        re.regex($e.metadata.description, `(?i)(rename|rm -f|unlink|delete)`)
      )
    )

  condition:
    $e
}

// ESXi has no Falcon sensor support; this assumes ESXi/vCenter syslog ingested into LogScale via a syslog collector into a dedicated repo (e.g. #repo=esxi_syslog)
#repo=esxi_syslog
("Accepted password" OR "Accepted publickey" OR "TSM-SSH" OR "esxcli vm process kill" OR "vim-cmd vmsvc/power" OR (/\.(vmdk|vmx|vmsd|vswp)/i AND ("Rename" OR "rm -f" OR "unlink" OR "delete")))
| Indicator := case {
    /(?i)(accepted password|accepted publickey|tsm-ssh)/ => "SSHEnabledOrUsed" ;
    /(?i)(esxcli vm process kill|vim-cmd vmsvc\/power)/ => "VMKillCommand" ;
    * => "DatastoreFileOp"
  }
| groupBy([host, Indicator], function=[count(as=EventCount), collect(@rawstring, limit=20)], limit=max)
| sort(EventCount, order=desc)