Security research

www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers

https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/

Published on: www.crowdstrike.com

ATT&CK techniques those detections carry

T1059.012Hypervisor CLI
T1007System Service Discovery
T1033System Owner/User Discovery
T1529System Shutdown/Reboot

4 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
ESXi VM Kill Via ESXCLI	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
ESXi VM List Discovery Via ESXCLI	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
ESXi System Information Discovery Via ESXCLI	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
ESXi Network Configuration Discovery Via ESXCLI	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 4 of 4

Filter in the catalogue