ESXi Storage Information Discovery Via ESXCLI

Title: ESXi Storage Information Discovery Via ESXCLI
Status: test
Description:Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.
References:
  -https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html
  -https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html
  -https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html
Author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
Date: 2023-09-04
modified:None
Tags:

• -'attack.discovery'
• -'attack.execution'
• -'attack.t1033'
• -'attack.t1007'
• -'attack.t1059.012'

Logsource:

• category: process_creation
• product: linux

Detection:
  selection_img:
    Image|endswith: '/esxcli'
    CommandLine|contains: 'storage'
  selection_cli:
    CommandLine|contains:
      -' get'
      -' list'

  condition:all of selection_*
Falsepositives:
  -Legitimate administration activities
Level: medium