CrowdStrike researchers have identified and cataloged 21 distinct methods for obfuscating shell commands on VMware ESX systems, a technique increasingly employed by threat actors to evade detection. The cybersecurity firm detailed its findings and released detection strategies to counter these advanced evasion tactics, which are often used in ransomware campaigns targeting hypervisors.
VMware ESX systems are a frequent target for ransomware groups such as SCATTERED SPIDER, BlackBasta, Royal (also known as BlackSuit), Akira, and the shinysp1d3r ransomware-as-a-service platform. These groups aim to reach the hypervisor layer to rapidly encrypt virtual machines, disable logging, and disrupt entire data centers.
Traditional detection methods that scan ESX shell logs for known malicious commands often assume that attackers will input commands in cleartext. However, command obfuscation is a well-established technique in Linux and Windows environments, with publicly available tools like Bashfuscator and Invoke-Obfuscation making it accessible to adversaries.
CrowdStrike's research demonstrates that obfuscation techniques are effective even within ESX's constrained BusyBox shell environment, extending beyond basic encoding to include cryptographic ciphers, infrastructure-keyed payloads, and alternative encoding systems. The researchers systematically tested these techniques on an ESX 7.0.3 build-20036589 system, specifically using the VMware-provided BusyBox located at /usr/lib/vmware/busybox/bin/busybox, which supports GNU math extensions like XOR, AND, and OR within `awk`.
Despite BusyBox's minimal footprint, its POSIX compliance for core shell functionality, including command substitution, variable expansion, and escape sequence interpretation, allows these obfuscation methods to succeed.
To help organizations detect these sophisticated attacks, CrowdStrike has developed regex-based detection patterns using its CrowdStrike Query Language (CQL). These patterns can be implemented as correlation rules within the CrowdStrike Falcon Next-Gen SIEM platform, enabling security teams to hunt for obfuscated command execution across ESX shell telemetry at scale. The company has shared the discovered techniques and corresponding detection strategies publicly.
