Techniques › T1564.006 › AN0912
AN0912 Analytic 0912
ESXi · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Direct execution of /bin/vmx or presence of rogue .vmx files not registered in vCenter inventory. Defender perspective: anomalous commands in shell history, edits to rc.local.d/local.sh for persistence.</p>
- Detects
- T1564.006 Run Virtual Instance
- Part of
- DET0321 Detection Strategy for Hidden Virtual Instance Execution
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| esxi:hostd | Execution of '/bin/vmx' or modifications to '/etc/rc.local.d/local.sh' | DC0064 Command Execution |
| esxi:vmkernel | VMX startup messages without associated vCenter inventory records | DC0028 Image Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
VMInventorySync | Cross-verify running VMs with vCenter inventory for rogue instances. |