Modification of ESXi Security and Encryption Enforcement Settings

This alert addresses the modification of critical security and encryption enforcement settings on VMware ESXi hosts. Attackers, including those associated with Black Basta ransomware, have been observed targeting the configuration of hypervisors to weaken their security posture. By disabling features such as secure boot or executable verification requirements, threat actors can bypass integrity checks to execute unauthorized or malicious code directly within the hypervisor environment. This behavior is typically identified through the monitoring of ESXi system logs where configuration commands are audited. Defenders should prioritize alerting on these modifications as they are often a precursor to further post-compromise activity, including payload deployment and persistent control over virtual infrastructure.

Impact

Successful modification of ESXi security settings grants an attacker the ability to bypass hypervisor protections, potentially leading to unauthorized execution of malicious binaries, persistence within the virtualization layer, and increased risk of widespread ransomware deployment across virtualized guest environments. This technique directly undermines the isolation guarantees of the hypervisor.

Recommendation

• Ingest VMware ESXi syslog data into the SIEM and ensure the appropriate Technology Add-on for VMware ESXi is configured to extract relevant command-line fields.
• Monitor for the specific command-line arguments identified in the detection logic below to identify attempts to lower the security threshold of ESXi hosts.
• Investigate any alert triggered by these rules with high priority, as legitimate administrative changes to security settings on production ESXi hosts should be infrequent and managed through change control.