Techniques › T1132 › AN0305
AN0305 Analytic 0305
ESXi · attack.mitre.org · ATT&CK Enterprise v19.2
<p>ESXi daemons (e.g., hostd, vpxa) are wrapped or impersonated to send large outbound traffic using gzip/Base64 encoding over SSH or HTTP. These actions follow suspicious logins or shell access.</p>
- Detects
- T1132 Data Encoding
- Part of
- DET0108 Detection Strategy for Data Encoding in C2 Channels
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| esxi:shell | base64 or gzip use within shell session | DC0064 Command Execution |
| esxi:vmkernel | Outbound traffic using encoded payloads post-login | DC0085 Network Traffic Content |
| ESXiLogs:authlog | Unexpected login followed by encoding commands | DC0002 User Account Authentication |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AuthSourceTrustLevel | Use to scope encoded traffic suspicion to accounts that should not initiate transfers |
ExfilBurstThreshold | Threshold for bursty outbound traffic size deviation from baseline |