« ESXi Audit Records Disabled ESXi ExecInstalledOnly Protection Disabled »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

ESXi Curl or Wget Activity

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Curl or Wget Activity

edit

Detects curl or wget from the ESXi shell. These tools download a file or contact a remote URL from the hypervisor. A successful transfer can place a package or script on the host, often under /tmp, where a later command can execute it against the datastore.

Rule type: query

Rule indices:

  • logs-vsphere.log-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Command and Control
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi
  • Threat: Ransomware

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Curl or Wget Activity

curl and wget download a file or check a URL from the ESXi shell. The shell log records the command even when the binary is missing or the host has no route to the destination.

Possible investigation steps

  • Read the URL and output path in message.
  • Check the same session for a file under /tmp, chmod, or execution of the downloaded file.
  • Confirm the URL with the virtualization owner.

False positive analysis

A documented download of a vendor package is commonly benign. A download of an unknown file into /tmp, followed by chmod, deserves review.

Response and remediation

  • If the download was not approved, remove the file and end the shell session.
  • Preserve shell.log and review commands issued after the download.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit
data_stream.dataset: "vsphere.log" and event.module: "vsphere" and message: ("curl" or "wget")

Framework: MITRE ATT&CKTM

« ESXi Audit Records Disabled ESXi ExecInstalledOnly Protection Disabled »