LoFP / administrators use `wget` to download a patch, vib, or support script during maintenance. confirm the url and whether the same session continues into file execution or virtual machine shutdown.

Techniques

• T1105

Sample rules

ESXi Curl or Wget Activity

• source: elastic
• technicques:
  • T1105

Description

Detects curl or wget from the ESXi shell. These tools download a file or contact a remote URL from the hypervisor. A successful transfer can place a package or script on the host, often under /tmp, where a later command can execute it against the datastore.

Detection logic

data_stream.dataset:vsphere.log and event.module:vsphere and message:((curl or wget) and not ("cURL Error" or "curl failed" or localhost or vmware.com))