MediumSplunk security content Raven Tait +1

ESXi Reverse Shell Patterns

This detection looks for reverse shell string patterns on an ESXi host, which may indicate that a threat actor is attempting to establish remote control over the system.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source category: vmware_esxi_syslog

Known benign triggers

Limited false positives in most environments, however tune as needed.

Detection rules

ESXi Reverse Shell Patterns

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules