Techniques
Sample rules
ESXi Sensitive Files Accessed
- source: splunk
- technicques:
- T1003.008
- T1005
Description
This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. Interaction with these files may indicate adversary reconnaissance, credential harvesting, or preparation for privilege escalation, lateral movement, or persistence.
Detection logic
`esxi_syslog` Message="*shell[*" Message IN ("*/etc/shadow*","*/etc/vmware/hostd/hostd.xml*", "*/etc/vmware/vpxa/vpxa.cfg*","*/etc/sfcb/sfcb.cfg*","*/etc/security/*", "*/etc/likewise/krb5-affinity.conf*","*/etc/vmware-vpx/vcdb.properties*")
| rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)"
| rex field=_raw "Z (?<dest>[\w\.]+)\s"
| stats min(_time) as firstTime max(_time) as lastTime count by dest user command
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `esxi_sensitive_files_accessed_filter`