Rule Info
Name
ESXi VIB Acceptance Level Changed to CommunitySupported
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects when the VIB acceptance level is modified to CommunitySupported on ESXi hosts, which can enable installation of untested and unsigned VIB packages.
This could indicate an attempt to install malicious software as VIBs at this level bypass VMware's security controls and are not supported by VMware or its partners.
Reference
Date
2025-05-19 00:00:00
Modified
None
Id
64c28fff-6949-470a-ba86-db4d257515f7
Tags
attack.execution attack.t1675 attack.persistence attack.t1505.006
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR