LoFP / administrators use `wget` to download a patch, vib, or support script during maintenance. confirm the url and whether the same session continues into file execution or virtual machine shutdown.

Techniques

• T1105

Sample rules

ESXi Curl or Wget Activity

• source: elastic
• technicques:
  • T1105

Description

Detects curl or wget from the ESXi shell. These tools download a file or contact a remote URL from the hypervisor. A successful transfer can place a package or script on the host, often under /tmp, where a later command can execute it against the datastore.

Detection logic

data_stream.dataset: "vsphere.log" and event.module: "vsphere" and message: ("curl" or "wget")