ESXi Payload Executed Against Datastore

Detects a program launched from the ESXi shell against /vmfs/volumes. The datastore holds the virtual disks of every guest. A process pointed at that path can read or encrypt those disks and take the hosted virtual machines offline.

Rule type: query
Rule indices:

  • logs-vsphere.log-*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Execution
  • Tactic: Impact
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi
  • Threat: Ransomware

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

This is the launch command. A path under /tmp, or python, is invoked with /vmfs/volumes as an argument. Ragnar Locker uses /tmp/<filename> /vmfs/volumes/<UUID>/. Pysa uses Python and passes the datastore path.

  • Read message for the executable path and the datastore argument.
  • Check the same session for chmod +x, VM process kills, snapshot removal, and find commands for vmdk files.
  • On the host, identify the file that was executed and whether it is still under /tmp or on a datastore.

Approved maintenance can run a known script from /tmp against a datastore. An unknown filename, especially after a chmod in the same session, is the ransomware launch pattern.

  • If the program was not approved, isolate the host. Leave powered-on VMs running so their disks stay locked.
  • Remove the file under /tmp and preserve shell.log.
  • Restore any datastore that was modified from an off-host backup.
data_stream.dataset:vsphere.log and event.module:vsphere and message:("/vmfs/volumes" and ("/tmp/" or python))

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK