355. Hunting for ESXCLI Abuse
Hello everyone! If we're talking about ransomware gangs, we're always talking about Command and Scripting Interpreter: Hypervisor CLI (T1059.012) . Yes, ransomware gangs love it! Let's look at RansomHouse , and focus on MrAgent. To obtain the MAC address, it runs the following command: esxcli --formatter=csv network nic list It runs the following command to collect information on the IP-address: esxcli --formatter=csv network nic list It also abuses ESXCLI to disable the firewall: esxcli network firewall set --enabled false So, for example, we can hunt for suspicious commands related to managing of host networking: event_type: "processcreatenix" AND cmdline: ("esxcli" AND "network") See you tomorrow!