Techniques › T1505.006 › AN1475
AN1475 Analytic 1475
ESXi · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Malicious VIB installation for persistence via
esxcli software vib install using --force or --no-sig-check, enabling custom startup scripts or firewall rules. Behavior chain: (1) unsigned/suspicious VIB installation → (2) startup script or binary placed in persistent boot path → (3) persistence across reboot via /etc/rc.local.d or other boot hook).</p>- Detects
- T1505.006 vSphere Installation Bundles
- Part of
- DET0535 Detect Abuse of vSphere Installation Bundles (VIBs) for Persistent Access
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| esxi:esxupdate | /var/log/esxupdate.log contains VIB installed with `--force` or `--no-sig-check` and non-standard acceptance levels | DC0038 Application Log Content |
| esxi:shell | `esxcli software vib install` with `--force` or `--no-sig-check` from shell history or `shell.log` | DC0064 Command Execution |
| linux:fim | Changes to /etc/rc.local.d/local.sh or creation of unexpected startup files in persistent partitions (/etc/init.d, /store, /locker) | DC0061 File Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AcceptanceLevel | Some environments may intentionally permit CommunitySupported or unsigned VIBs—filter by known allowed publishers. |
InstallCommandThreshold | Set alerting thresholds for frequency of VIB install attempts per host/user/time window. |
StartupPathRegex | Tune regex for monitoring startup file locations based on ESXi image customization. |