Attack Chain

1. Attacker gains initial access to the ESXi host through an undisclosed method.
2. Attacker executes commands via the ESXi shell or through esxcli.
3. Attacker uses esxcli vm process list to enumerate running virtual machines on the host.
4. The attacker filters the output of esxcli vm process list using awk or similar tools to extract VM process IDs.
5. Attacker uses esxcli vm process kill with the --format-param option to terminate multiple virtual machine processes.
6. Alternatively, the attacker uses pkill -9 vmx-* to forcibly terminate all VM processes.
7. Virtual machines are abruptly shut down, leading to data loss and service disruption.
8. The attack may be a precursor to data exfiltration or encryption as part of a ransomware attack.

Impact

Successful bulk VM termination can lead to significant disruption of services, data loss, and potential financial losses. The number of victims and the scope of impact depend on the criticality of the virtual machines affected. In ransomware scenarios, this action serves to maximize the impact and pressure victims into paying the ransom. Sectors heavily reliant on virtualization, such as cloud providers, financial institutions, and healthcare organizations, are particularly vulnerable.

Recommendation

• Configure ESXi hosts to forward syslog output to your SIEM to collect the necessary data (VMWare ESXi Syslog).
• Deploy the Sigma rules provided in this brief to your SIEM to detect bulk VM termination activity and tune them based on your environment.
• Investigate any alerts triggered by these rules to determine the scope and impact of the activity.
• Review and harden access controls to ESXi hosts to prevent unauthorized command execution.
• Consider implementing rate limiting or alerting on ESXi command execution to detect anomalous activity.
• Ingest logs with the appropriate Splunk Technology Add-on for VMware ESXi Logs, ensuring field extractions and CIM compatibility, to properly utilize the provided Splunk search query.