SSH Service Enabled On ESXi Host Via Vim-Cmd

Rule Info

Name
SSH Service Enabled On ESXi Host Via Vim-Cmd
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects the execution of "vim-cmd" with the "hostsvc/enable_ssh" flag, in order to enable the SSH service on an ESXi host. If enabled, it allows a user to connect to the host remotely via SSH, to for perform command-line management and troubleshooting. In general VMware does not recommend enabling SSH on vSphere. Investigate the source of such execution and make sure it is legitimate.
Reference
https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html
Date
2024-08-14 00:00:00
Modified
None
Id
1d205898-fb5e-4a51-97b6-be7e220c9df0
Tags
attack.execution
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022