Vendor: VMware
July 25, 2023 · View on GitHub
Product: VMware ESXi
| Rules | Models | MITRE TTPs | Event Types | Parsers |
|---|---|---|---|---|
| 52 | 28 | 11 | 1 | 1 |
| Use-Case | Event Types/Parsers | MITRE TTP | Content |
|---|---|---|---|
| Brute Force Attack | remote-logon ↳ vmware-ssh-login ↳ vmware-esxi-login ↳ vmware-esxi-login-1 | T1078 - Valid Accounts |
|
| Compromised Credentials | remote-logon ↳ vmware-ssh-login ↳ vmware-esxi-login ↳ vmware-esxi-login-1 | T1021 - Remote Services T1078 - Valid Accounts T1078.003 - Valid Accounts: Local Accounts T1133 - External Remote Services |
|
| Evasion | remote-logon ↳ vmware-ssh-login ↳ vmware-esxi-login ↳ vmware-esxi-login-1 | T1090.003 - Proxy: Multi-hop Proxy |
|
| Lateral Movement | remote-logon ↳ vmware-ssh-login ↳ vmware-esxi-login ↳ vmware-esxi-login-1 | T1018 - Remote System Discovery T1021 - Remote Services T1078 - Valid Accounts T1078.003 - Valid Accounts: Local Accounts T1550 - Use Alternate Authentication Material T1550.002 - Use Alternate Authentication Material: Pass the Hash T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting |
|
| Malware | remote-logon ↳ vmware-ssh-login ↳ vmware-esxi-login ↳ vmware-esxi-login-1 | T1078 - Valid Accounts T1204 - User Execution |
|
| Privilege Abuse | remote-logon ↳ vmware-ssh-login ↳ vmware-esxi-login ↳ vmware-esxi-login-1 | T1078 - Valid Accounts |
|
| Privilege Escalation | remote-logon ↳ vmware-ssh-login ↳ vmware-esxi-login ↳ vmware-esxi-login-1 | T1078 - Valid Accounts |
|
| Privileged Activity | remote-logon ↳ vmware-ssh-login ↳ vmware-esxi-login ↳ vmware-esxi-login-1 | T1068 - Exploitation for Privilege Escalation T1078 - Valid Accounts |
|
| Ransomware | remote-logon ↳ vmware-ssh-login ↳ vmware-esxi-login ↳ vmware-esxi-login-1 | T1078 - Valid Accounts |
|
ATT&CK Matrix for Enterprise
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|
| External Remote Services Valid Accounts | User Execution | External Remote Services Valid Accounts | Valid Accounts Exploitation for Privilege Escalation | Valid Accounts Use Alternate Authentication Material Use Alternate Authentication Material: Pass the Hash Valid Accounts: Local Accounts | Steal or Forge Kerberos Tickets Steal or Forge Kerberos Tickets: Kerberoasting | Remote System Discovery | Remote Services Use Alternate Authentication Material | Proxy: Multi-hop Proxy Proxy |