---
title: ESXi Shell Command Obfuscation
description: Detects ESXi shell commands that rebuild a command with encoding instead of writing it in clear text, including octal and hex printf, Python chr(), awk...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_shell_command_obfuscation
products:
  - Elastic Security
---

# ESXi Shell Command Obfuscation
Detects ESXi shell commands that rebuild a command with encoding instead of writing it in clear text, including
octal and hex `printf`, Python `chr()`, `awk` `%c` sequences, reversed strings, and invisible Unicode. The shell
log then hides the administrative command. The decoded action can still change syslog, the firewall, or other
host settings.
**Rule type**: query
**Rule indices**:
- logs-vsphere.log-*

**Rule Severity**: high
**Risk Score**: 73
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://lolesxi-project.github.io/LOLESXi/#](https://lolesxi-project.github.io/LOLESXi/#)](https://lolesxi-project.github.io/LOLESXi/#)
- [[https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html](https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html)](https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html)
- [[https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21](https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21)](https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21)

**Tags**:
- Domain: Endpoint
- Data Source: VMware vSphere
- Use Case: Threat Detection
- Tactic: Defense Evasion
- Tactic: Execution
- Resources: Investigation Guide
- Rule Type: Custom Query (KQL)
- Platform: VMware ESXi
- Threat: Encoding-Based Obfuscation

**Version**: 1
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: [https://www.elastic.co/docs/reference/integrations/vsphere](https://www.elastic.co/docs/reference/integrations/vsphere)

## Investigation guide


## Triage and analysis


### Investigating ESXi Shell Command Obfuscation

ESXi shell.log stores the command text. Encoding the letters of esxcli is an attempt to keep a destructive command out of simple string searches. The decoded action is often a syslog reset or a VM listing.

#### Possible investigation steps

- Copy message and decode it. Octal 145 163 170, hex 65 73 78, chr(101), and repeated percent-c sequences all spell esx.
- If the decoded command resets syslog, changes the firewall, or kills a VM, follow that detection as well.
- Compare the account and source with normal ESXi administration. Operators rarely need these encodings.


### False positive analysis

A lab or training host may replay published obfuscation samples. On a production host, treat the encoded command as hostile until the decoded text is explained.

### Response and remediation

- Decode and record the command, then check esxcli system syslog config get and the firewall state in case the payload already ran.
- End the shell session and disable SSH if it was not required.
- Preserve shell.log before rotation. The encoded line is the evidence.


## Rule Query

```kuery
data_stream.dataset: "vsphere.log" and (
  message: (
    "chr(101)" or
    "%c%c%c%c%c%c" or
    "ilcxse" or
    "0xe2,0x80,0x8b" or
    "0xf3,0xb0,0x80,0x80" or
    "\\x65\\x73\\x78" or
    "\\145\\163\\170"
  )
)
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Defense Evasion
  - Id: TA0005
  - Reference URL: [[https://attack.mitre.org/tactics/TA0005/](https://attack.mitre.org/tactics/TA0005/)](https://attack.mitre.org/tactics/TA0005/)
- Technique:
  - Name: Obfuscated Files or Information
  - Id: T1027
  - Reference URL: [[https://attack.mitre.org/techniques/T1027/](https://attack.mitre.org/techniques/T1027/)](https://attack.mitre.org/techniques/T1027/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Execution
  - Id: TA0002
  - Reference URL: [[https://attack.mitre.org/tactics/TA0002/](https://attack.mitre.org/tactics/TA0002/)](https://attack.mitre.org/tactics/TA0002/)
- Technique:
  - Name: Command and Scripting Interpreter
  - Id: T1059
  - Reference URL: [[https://attack.mitre.org/techniques/T1059/](https://attack.mitre.org/techniques/T1059/)](https://attack.mitre.org/techniques/T1059/)
- Sub Technique:
  - Name: Unix Shell
  - Id: T1059.004
  - Reference URL: [[https://attack.mitre.org/techniques/T1059/004/](https://attack.mitre.org/techniques/T1059/004/)](https://attack.mitre.org/techniques/T1059/004/)