GitHub Repo

Detection: ESXi Malicious VIB Forced Install

Updated Date: 2026-05-13 ID: 5d4d2cd2-7b65-4474-97cf-e9b203bcd770 Author: Raven Tait, Splunk Type: TTP Product: Splunk Enterprise Security

Description

Detects potentially malicious installation of VMware Installation Bundles (VIBs) using the --force flag. The --force option bypasses signature and compatibility checks, allowing unsigned, community-supported, or incompatible VIBs to be installed on an ESXi host. This behavior is uncommon in normal administrative operations and is often observed in post-compromise scenarios where adversaries attempt to install backdoored or unauthorized kernel modules, drivers, or monitoring tools to establish persistence or gain deeper control of the hypervisor.

1`esxi_syslog` Message="* image profile with validation disabled. *" OR Message="* image profile bypassing signing and acceptance level verification. *" OR Message="* vib without valid signature, *" 
2| rex field=_raw "Z (?<dest>[\w\.]+)\s" 
3| stats min(_time) as firstTime max(_time) as lastTime count by dest Message 
4| `security_content_ctime(firstTime)` 
5| `security_content_ctime(lastTime)` 
6| `esxi_malicious_vib_forced_install_filter`

Data Source

Name Platform Sourcetype Source
VMWare ESXi Syslog Other 'vmw-syslog' 'vmware:esxlog'

Macros Used

Name Value
security_content_ctime convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
esxi_malicious_vib_forced_install_filter search *
esxi_malicious_vib_forced_install_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1505.006 vSphere Installation Bundles Persistence
Installation
DE.CM
CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Finding (Notable) Yes
Rule Title %name%
Rule Description %description%
Notable Event Fields user, dest
Creates Intermediate Finding (Risk Event) No
TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.

Known False Positives

Some third party vendor VIBs or patches may require the force option.

Associated Analytic Story

Finding

Title Entity Field Entity Type Risk Score
A VIB was installed on ESXi $dest$ with the force flag. dest system 50

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset vmware:esxlog vmw-syslog
Integration ✅ Passing Dataset vmware:esxlog vmw-syslog

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 5