ESXi Autostart Disabled via Vim-Cmd

Rule Info

Name
ESXi Autostart Disabled via Vim-Cmd
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects attempts to disable automatic startup of Virtual Machines on ESXi hosts using vim-cmd.
Reference
https://lolesxi-project.github.io/LOLESXi/lolesxi/Binaries/vim-cmd/#disable%20startup
Date
2025-05-22 00:00:00
Modified
None
Id
c6858ee2-6b11-4e2f-9b42-4f53e2ab3fe4
Tags
attack.impact attack.t1529 attack.execution attack.t1675
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022