Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,374
detections

Search detections

Filters

Showing 30 of 11,374

SAP BTP - Critical vulnerability finding in custom app

Identifies SAP BTP Application Vulnerability Report Service findings where the CVSS score exceeds a configurable threshold (default 9.0, i.e. Critical severity). Such findings indicate custom applications deployed on SAP BTP that carry vulnerable open-source packages or components with a known, high-impact CVE. These risky applications should be prioritized for remediation and reviewed for signs of exploitation.

T1190

Licence: MIT License
Published: Oct 2, 2026

MediumElastic detection rules

Lure-Themed Internet-Delivered RMM Executable

Identifies an Internet-delivered remote monitoring and management (RMM) executable whose filename disguises it as a document, invitation, or another company's application. Attackers may use that lure, often through social engineering, to gain remote access to the endpoint.

T1036T1204T1204.002T1219T1219.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

LowElastic detection rules

Potential RMM Execution from a Commonly Abused Web Service

Identifies execution of software whose reported code-signature subject matches a known remote monitoring and management (RMM) publisher with a download origin on a commonly abused web service. Adversaries use these services to deliver remote-access software during social engineering and intrusion campaigns.

T1105T1219T1219.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

First Time Python Created a LaunchAgent or LaunchDaemon

Detects the first time a Python process creates or modifies a LaunchAgent or LaunchDaemon plist file on a given host. Malicious Python scripts, compromised dependencies, or model file deserialization can establish persistence on macOS by writing plist files to LaunchAgent or LaunchDaemon directories. Legitimate Python processes do not typically create persistence mechanisms, so a first occurrence is a strong indicator of compromise.

T1543T1543.001T1543.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

First Time Python Spawned a Shell on Host

Detects the first time a Python process spawns a shell on a given host. Malicious Python scripts, compromised dependencies, or model file deserialization can result in shell spawns that would not occur during normal workflows. Since legitimate Python processes rarely shell out to interactive shells, a first occurrence of this behavior on a host is a strong signal of potential compromise.

T1059T1059.004T1059.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

First Time Python Accessed Sensitive Credential Files

Detects the first time a Python process accesses sensitive credential files on a given host. This behavior may indicate post-exploitation credential theft via a malicious Python script, compromised dependency, or malicious model file deserialization. Legitimate Python processes do not typically access credential files such as SSH keys, AWS credentials, browser cookies, Kerberos tickets, or keychain databases, so a first occurrence is a strong indicator of compromise.

T1539T1552T1552.001T1555T1555.001+2 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

CriticalElastic detection rules

Zimbra Swatchdog SNMP Command Injection Execution

Detects a Unix shell launched by Perl from a generated Zimbra ".swatchdog_script" when the shell command line contains an "snmptrap" invocation and Zimbra SNMP service fields, followed by an unexpected child process other than "snmptrap". This sequence provides high-confidence evidence of external command execution through CVE-2026-73570, an unauthenticated command-injection vulnerability in Zimbra's SNMP monitoring path.

T1059T1059.004T1190

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Root Password Changed

Detects a change to the ESXi root password, the credential for SSH, the Host Client, and the API. Replacing it locks out the previous password and gives the new value full control of the host. Hostd records `Password was changed for account root`. The shell records `esxcli system account set -i root`.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Account Granted Admin Role

Detects an ESXi account being granted the Administrator role. Administrator is full control of the host, including the firewall, SSH, accounts, and every virtual machine. Granting it to another account keeps that access after the original session ends.

T1098

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Local Account Created

Detects creation of a local ESXi account. A new account is a separate login that remains after the session that created it. It has no rights until a role is assigned, and it is the first step toward a persistent login on the host.

T1136T1136.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi SSH Session from vpxuser

Identifies a successful SSH session opened by the privileged vpxuser account. vpxuser is a service account used by VMware vCenter Server to manage ESXi hosts. An SSH session from that account reaches the host shell directly, outside the vCenter management path, and is a sign the credential is being reused with malicious intent.

T1021T1021.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi SSH Access Enabled

Detects ESXi SSH being turned on. SSH is often left disabled so the host is managed through the local console, the Host Client, or vCenter. Enabling it opens a remote shell that can copy files onto the host and run commands against the datastore.

T1021T1021.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Root Password Accepted from Remote Host

Detects hostd accepting the ESXi root password from a remote address. A successful remote root login opens the Host Client or the API with full control of the host. Local sessions from 127.0.0.1 are left out of the rule.

T1078T1078.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Virtual Machine Process Killed

Detects termination of a virtual machine process on an ESXi host, including `esxcli vm process kill`, `pkill` of `vmx` processes, and `vmdumper` suspend. A running VM holds a lock on its disks. Stopping the process releases that lock and makes the disks writable.

T1489

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Virtual Machine Powered Off

Detects `vim-cmd vmsvc/power.off` on an ESXi host. Powering a virtual machine off releases the lock the hypervisor holds on its virtual disks. With the guest stopped, those disks can be rewritten or encrypted while the machine is down.

T1529

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Virtual Machine Snapshot Removed

Detects removal of all snapshots for an ESXi virtual machine. Snapshots are on-host recovery points for a guest. Removing all of them deletes those recovery points, so the virtual machine cannot be reverted to an earlier disk state.

T1490

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Payload Executed Against Datastore

Detects a program launched from the ESXi shell against `/vmfs/volumes`. The datastore holds the virtual disks of every guest. A process pointed at that path can read or encrypt those disks and take the hosted virtual machines offline.

T1059T1059.004T1486

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

LowElastic detection rules

ESXi Virtual Machine Process List

Detects `esxcli vm process list` on an ESXi host. The command lists running virtual machines and the world IDs of their `vmx` processes. Those IDs are what a later kill command uses to stop the VMs and release the locks on their virtual disks.

T1057

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

LowElastic detection rules

ESXi Virtual Disk Files Enumerated

Detects a shell search under `/vmfs/volumes` for virtual disk and snapshot files (`vmdk`, `vmsn`, `vmsd`). Those files are the guest disks and their on-host recovery points. Listing them builds the set of files a later process can encrypt or delete.

T1083

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

LowElastic detection rules

ESXi System and Account Enumeration

Detects shell commands that collect ESXi host details or the local account list, including `uname -a`, system version, hostname, and `esxcli system account list`. The output identifies the build and the accounts that can log in. Listing accounts shows which identities exist before one of them is changed or used.

T1082T1087T1087.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Syslog Remote Host Reset

Detects the ESXi remote syslog destination being cleared with `--reset=loghost`. The loghost is where host logs are forwarded for retention and detection. Clearing it keeps later commands on the host only, so an external collector stops receiving them.

T1562T1562.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

CriticalElastic detection rules

ESXi Host Prepared for an Unsigned Install

Detects three changes on the same ESXi host within 1 hour: SSH enabled, ExecInstalledOnly turned off, and a VIB install with `-f` or `--force` and `--no-sig-check`. Together they open a remote shell, allow unsigned code to run, and bypass VIB signature checks. That sequence prepares the host to receive and run a package the normal controls would reject.

T1021T1021.004T1553T1553.006T1562+1 more

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Shell Command Obfuscation

Detects ESXi shell commands that rebuild a command with encoding instead of writing it in clear text, including octal and hex `printf`, Python `chr()`, `awk` `%c` sequences, reversed strings, and invisible Unicode. The shell log then hides the administrative command. The decoded action can still change syslog, the firewall, or other host settings.

T1027T1059T1059.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Lockdown Mode Disabled

Detects the disabling of ESXi lockdown mode, a critical security feature that restricts remote access to ESXi hosts. When lockdown mode is disabled, remote users can directly access and modify ESXi host configurations using the root login. When enabled, the ESXi host is accessible only through the local console or vCenter Server.

T1562T1562.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Host Logs Deleted with rm

Detects a shell `rm` of a path under `/var/log` or of a `*.log` name. Those files hold shell commands, authentication, and hostd activity. Removing them takes away the record of what changed on the host.

T1070T1070.002T1070.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Attempt to Force Install a VMware VIB Package

Detects an attempt to install a VMware VIB with `--force`. A VIB is how ESXi adds drivers and host software, and signature checks normally block an unsigned package. `--force` skips that validation, so an untrusted package can be written onto the hypervisor and affect every virtual machine it runs.

T1553T1553.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi Firewall Disabled

Detects the ESXi firewall being turned off or switched to a default allow. The firewall is the host filter for management services. Disabling it, or setting the default action to accept, lets later connections reach services that were previously blocked.

T1562T1562.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

HighElastic detection rules

ESXi ExecInstalledOnly Protection Disabled

Detects ESXi ExecInstalledOnly protection being turned off. The setting limits execution to binaries that were installed by a VIB and have not been modified. When it is set to false, the host can run files from paths such as `/tmp` that were never part of the system image.

T1562T1562.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi File Made Executable with chmod

Detects chmod making a file executable on an ESXi host, including `+x` and numeric modes such as `755` and `777`. The host will not run a file until the execute bit is set. Making a file under `/tmp` executable is the step that lets a later command launch it against the datastore.

T1222T1222.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

MediumElastic detection rules

ESXi Audit Records Disabled

Detects ESXi audit record transmission being turned off, locally or to a remote collector. Audit records are the host's own trail of administrative changes. Disabling them means later changes to accounts, the firewall, and SSH are not recorded there.

T1562T1562.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 2, 2026

Load more detections

Loading detection rules

Back to results

CriticalElastic detection rules Elastic

ESXi Host Prepared for an Unsigned Install

Description

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite Windows
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Known benign triggers

A documented maintenance window can enable SSH, relax ExecInstalledOnly, and force-install a vendor VIB on the same host. Confirm the change ticket and the VIB name before treating the sequence as malicious.

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Defense Impairment

T1553Subvert Trust Controls28 detections cover this technique
- T1553.006Code Signing Policy Modification 4 detections cover this technique
T1685Disable or Modify ToolsMapped as T1562 and T1562.001, withdrawn by ATT&CK.278 detections cover this technique

Lateral Movement

T1021Remote Services180 detections cover this technique
- T1021.004SSH 42 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html	Unclassified	25
detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21	Unclassified	25
lolesxi-project.github.io/LOLESXi/#	Unclassified	25

From the source

At source: Open at source
Upstream identifier: 12c56e4a-8d36-5dab-a5b6-5322db31c901
Tagged by the source as: Data Source: VMware vSphereDomain: EndpointPlatform: VMware ESXiResources: Investigation GuideRule Type: ES|QLTactic: Defense EvasionTactic: Lateral MovementUse Case: Threat Detection

Licence

Published under: Elastic License 2.0Read the licence
Attribution: Required

Authorship

Written by: Elastic
Published: Oct 2, 2026
Version: 1