Sigma rule: Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group

Rule

Title

Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group

Status

test

Level

high

Author

frack113

Date

2024-07-29

File

rules-emerging-threats/2024/Exploits/CVE-2024-37085/proc_creation_win_exploit_cve_2024_37085_esxi_admins_group_creation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of the "net.exe" command in order to add a group named "ESX Admins".
This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor.
VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

Log source

product

windows

category

process_creation

Detection

selection_net_img:
    - Image|endswith:
          - '\net.exe'
          - '\net1.exe'
    - OriginalFileName:
          - 'net.exe'
          - 'net1.exe'
selection_net_cmd:
    CommandLine|contains|all:
        - '/add'
        - '/domain'
        - 'ESX Admins'
        - 'group'
selection_powershell_img:
    - Image|endswith:
          - '\PowerShell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'PowerShell.exe'
          - 'pwsh.dll'
selection_powershell_cli:
    CommandLine|contains|all:
        - 'New-ADGroup'
        - 'ESX Admins'
condition: all of selection_net_* or all of selection_powershell_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• cve.2024-37085
• detection.emerging-threats

CVEs this rule names

• CVE-2024-37085

References

• https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2024/Exploits/CVE-2024-37085/proc_creation_win_exploit_cve_2024_37085_esxi_admins_group_creation.yml