Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

ESXi Malicious VIB Forced Install

Detects potentially malicious installation of VMware Installation Bundles (VIBs) using the --force flag. The --force option bypasses signature and compatibility checks, allowing unsigned, community-supported, or incompatible VIBs to be installed on an ESXi host. This behavior is uncommon in normal administrative operations and is often observed in post-compromise scenarios where adversaries attempt to install backdoored or unauthorized kernel modules, drivers, or monitoring tools to establish persistence or gain deeper control of the hypervisor.

ATT&CK coverage

Covers 1 technique no other published rule covers.

Outside the enterprise matrix

T1505.006

Detection requirements

Log source category: vmware_esxi_syslog

What the source says

What fires this without an attack behind it

Some third party vendor VIBs or patches may require the force option.

References

https://detect.fyi/detecting-and-responding-to-esxi-compromise-with-splunk-f33998ce7823

Tagged by the source as

Black Basta RansomwareChina-Nexus Threat ActivityESXi Post CompromiseInfrastructureapplicationSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.