Nathan Burns

GitHub - AlbinoGazelle/esxi-testing-toolkit: 🧰 ESXi Testing Tookit is a command-line utility designed to help security teams test ESXi detections. 🧰 ESXi Testing Tookit is a command-line utility designed to help security teams test ESXi detections. - AlbinoGazelle/esxi-testing-toolkit

Looking to start deploying detections in ESXi environments? I'm releasing ESXi Testing Toolkit: github.com/AlbinoGazell...

It's a Python-based CLI tool that contains adversary tests from places like LOLESXi and Atomic Red Team. It features 21 different tests, 18 pre-made Sigma rules, and much more!

13.01.2025 23:27 — 👍 2    🔁 0    💬 0    📌 1

Always rewarding to contribute back to open source projects, but it's even better when they give you some free swag. Thanks Red Canary!

21.12.2024 01:28 — 👍 2    🔁 0    💬 0    📌 0

You could also detect this via /var/log/shell.log and/or /var/log/auth.log but you'd be detecting the command line execution and not the underlying procedure of interacting with the ESXi API.

There's numerous ways to achieve an objective, focus on coverage!

04.12.2024 23:28 — 👍 0    🔁 0    💬 0    📌 0

Threat Assessment: Howling Scorpius (Akira Ransomware) Howling Scorpius, active since 2023, uses Akira ransomware to target businesses globally, employing a double-extortion strategy and upgrading tools regularly. Howling Scorpius, active since 2023, uses...

Neat blog post by Unit42 on Akira Ransomware variants designed specifically for ESXi hosts.

Luckily, ESXi will log when syslog and coredump settings are modified in /var/log/hostd.log. See below gist for artifacts.

gist.github.com/AlbinoGazell...

Ref: unit42.paloaltonetworks.com/threat-asses...

04.12.2024 23:24 — 👍 1    🔁 0    💬 1    📌 0

Pay-what-you-want training that covers Sigma/pySigma, Detections as Code, and Splunk? Support this!

25.11.2024 22:26 — 👍 1    🔁 0    💬 0    📌 0

Getting a sense of the source for each detection would be good. Did these spawn from past incidents, internal research, fancy CTI reports or other?

Figuring out what native alerting mechanism exists would help to remove potential duplicative alerts and let engineers focus on what matters, gaps.

25.11.2024 05:11 — 👍 1    🔁 0    💬 0    📌 0

I made a Detection Engineering starter pack, will be adding more as more folks jump over to bluesky! go.bsky.app/HenXJUR

18.11.2024 15:37 — 👍 125    🔁 55    💬 8    📌 3

Interesting discovery while researching potential ESXi detections. If you execute a command over ssh (e.g ssh root@esxi.local "echo 123") that isn't logged to /var/log/shell.log but rather /var/log/auth.log as "User 'root' running command echo 123".

Make sure your detections look at both log files!

23.11.2024 23:24 — 👍 1    🔁 1    💬 0    📌 0