Lockdown Mode - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/lockdown-mode/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000ESXi Lockdown Mode Disabledhttps://feed.craftedsignal.io/briefs/2024-01-esxi-lockdown-disabled/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-esxi-lockdown-disabled/Detection of ESXi Lockdown Mode being disabled, potentially indicating attacker attempts to weaken host security controls for broader access, data exfiltration, or VM tampering.This brief focuses on detecting the disabling of Lockdown Mode on VMware ESXi hosts. Lockdown Mode restricts access to the ESXi host, limiting remote connections and hardening the system against unauthorized modifications. When an attacker disables Lockdown Mode, it expands the attack surface, allowing for broader remote access via SSH or the host client. This action typically occurs post-compromise, as attackers attempt to weaken security controls to facilitate lateral movement, data exfiltration, or VM tampering. This activity is particularly relevant for organizations running virtualized environments with sensitive data, as it indicates a significant compromise of hypervisor security. The provided detection identifies syslog messages related to Lockdown Mode being disabled.

Attack Chain

  1. Initial Access: The attacker gains initial access to a privileged account with administrative rights on the ESXi host.
  2. Privilege Escalation: The attacker escalates privileges if necessary to gain the required permissions to modify ESXi host settings.
  3. Discovery: The attacker uses commands or tools to discover the current Lockdown Mode status on the ESXi host.
  4. Defense Evasion: The attacker disables Lockdown Mode on the ESXi host, weakening security controls and enabling broader remote access. This is achieved by using either the vSphere client or command line interface (CLI).
  5. Lateral Movement: With Lockdown Mode disabled, the attacker can leverage gained access to move laterally to other VMs or ESXi hosts within the environment.
  6. Credential Access: The attacker attempts to gather credentials stored on the ESXi host or within the VMs to further expand their access.
  7. Data Exfiltration/VM Tampering: The attacker accesses sensitive data stored on the VMs or tampers with VM configurations to cause disruption or further compromise the environment.

Impact

Successful exploitation can lead to a complete compromise of the virtualized environment, potentially affecting hundreds or thousands of virtual machines and the data they contain. Disabling Lockdown Mode can lead to data exfiltration, ransomware deployment across VMs, and disruption of critical services. Organizations in all sectors relying on VMware ESXi are at risk. The financial impact can be substantial, including recovery costs, downtime, and potential regulatory fines.

Recommendation

  • Enable Syslog forwarding from all ESXi hosts to a central logging server to capture the events necessary for detection (VMWare ESXi Syslog).
  • Deploy the Sigma rule "ESXi Lockdown Mode Disabled" to your SIEM and tune for your specific environment to detect instances of Lockdown Mode being disabled.
  • Investigate any alerts generated by the Sigma rule, focusing on the user accounts and IP addresses involved in disabling Lockdown Mode (Sigma rule).
  • Implement multi-factor authentication (MFA) for all privileged accounts to reduce the risk of initial access.
]]>highadvisoryesxivmwarelockdown modedefense evasiont1562