ESXi Shell Command Obfuscation

Detects ESXi shell commands that rebuild a command with encoding instead of writing it in clear text, including octal and hex printf, Python chr(), awk %c sequences, reversed strings, and invisible Unicode. The shell log then hides the administrative command. The decoded action can still change syslog, the firewall, or other host settings.

Rule type: query
Rule indices:

  • logs-vsphere.log-*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Defense Evasion
  • Tactic: Execution
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi
  • Threat: Encoding-Based Obfuscation

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

ESXi shell.log stores the command text. Encoding the letters of esxcli is an attempt to keep a destructive command out of simple string searches. The decoded action is often a syslog reset or a VM listing.

  • Copy message and decode it. Octal 145 163 170, hex 65 73 78, chr(101), and repeated percent-c sequences all spell esx.
  • If the decoded command resets syslog, changes the firewall, or kills a VM, follow that detection as well.
  • Compare the account and source with normal ESXi administration. Operators rarely need these encodings.

A lab or training host may replay published obfuscation samples. On a production host, treat the encoded command as hostile until the decoded text is explained.

  • Decode and record the command, then check esxcli system syslog config get and the firewall state in case the payload already ran.
  • End the shell session and disable SSH if it was not required.
  • Preserve shell.log before rotation. The encoded line is the evidence.
data_stream.dataset: "vsphere.log" and (
  message: (
    "chr(101)" or
    "%c%c%c%c%c%c" or
    "ilcxse" or
    "0xe2,0x80,0x8b" or
    "0xf3,0xb0,0x80,0x80" or
    "\\x65\\x73\\x78" or
    "\\145\\163\\170"
  )
)

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK