LoFP / a support script stored under `/tmp` or a python inventory check can be pointed at a datastore during maintenance. confirm the file name, the account, and whether virtual machines were shut down in the same session.

Techniques

• T1059
• T1486

Sample rules

ESXi Payload Executed Against Datastore

• source: elastic
• technicques:
  • T1059
  • T1486

Description

Detects a program launched from the ESXi shell against /vmfs/volumes. The datastore holds the virtual disks of every guest. A process pointed at that path can read or encrypt those disks and take the hosted virtual machines offline.

Detection logic

data_stream.dataset:vsphere.log and event.module:vsphere and message:("/vmfs/volumes" and ("/tmp/" or python))