ESXi Virtual Disk Files Enumerated

Detects a shell search under /vmfs/volumes for virtual disk and snapshot files (vmdk, vmsn, vmsd). Those files are the guest disks and their on-host recovery points. Listing them builds the set of files a later process can encrypt or delete.

Rule type: query
Rule indices:

  • logs-vsphere.log-*

Rule Severity: low
Risk Score: 21
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Discovery
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi
  • Threat: Ransomware

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

The datastore path and the vmdk family of extensions are how ESXi ransomware chooses what to encrypt. The search itself does not change files.

  • Read the exact find arguments in message, including any -name filter.
  • Correlate with later vm process kill, power.off, or snapshot.removeall from the same session.
  • If the command stands alone during a known support window, it is often benign.

Support bundles and storage reports list virtual disks. Escalation is for a search followed by VM shutdown or snapshot deletion.

  • If the same session starts killing VMs or deleting snapshots, isolate the host.
  • Otherwise record the account and command for hunting across other ESXi hosts.
data_stream.dataset:vsphere.log and message:("/vmfs/volumes" and find and (vmdk or vmsd or vmsn))

Framework: MITRE ATT&CK