GitHub Repo

Detection: ESXi Malicious VIB Forced Install

Updated Date: 2025-05-09 ID: 5d4d2cd2-7b65-4474-97cf-e9b203bcd770 Author: Raven Tait, Splunk Type: TTP Product: Splunk Enterprise Security

Description

Detects potentially malicious installation of VMware Installation Bundles (VIBs) using the --force flag. The --force option bypasses signature and compatibility checks, allowing unsigned, community-supported, or incompatible VIBs to be installed on an ESXi host. This behavior is uncommon in normal administrative operations and is often observed in post-compromise scenarios where adversaries attempt to install backdoored or unauthorized kernel modules, drivers, or monitoring tools to establish persistence or gain deeper control of the hypervisor.

1`esxi_syslog` Message="* image profile with validation disabled. *" OR Message="* image profile bypassing signing and acceptance level verification. *" OR Message="* vib without valid signature, *" 
2| rex field=_raw "Z (?<dest>[\w\.]+)\s" 
3| stats min(_time) as firstTime max(_time) as lastTime count by dest Message 
4| `security_content_ctime(firstTime)` 
5| `security_content_ctime(lastTime)` 
6| `esxi_malicious_vib_forced_install_filter`

Data Source

Name Platform Sourcetype Source
VMWare ESXi Syslog N/A 'vmw-syslog' 'vmware:esxlog'

Macros Used

Name Value
esxi_syslog sourcetype=vmw-syslog OR sourcetype=vmware:esxlog*
esxi_malicious_vib_forced_install_filter search *
esxi_malicious_vib_forced_install_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1505.006 vSphere Installation Bundles Persistence
Installation
DE.CM
CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Notable Yes
Rule Title %name%
Rule Description %description%
Notable Event Fields user, dest
Creates Risk Event True
This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.

Known False Positives

Some third party vendor VIBs or patches may require the force option.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

A VIB was installed on ESXi $dest$ with the force flag.

Risk Object Risk Object Type Risk Score Threat Objects
dest system 60 No Threat Objects

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset vmware:esxlog vmw-syslog
Integration ✅ Passing Dataset vmware:esxlog vmw-syslog

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1