UNC3886G1048 ↗
Has used vSphere Installation Bundles (VIBs) to install malware and establish persistence across ESXi hypervisors.123
tfMITRE ATT&CK sub-technique
vSphere Installation Bundles T1505.006
sub-technique of T1505 Server Software Component
- Tactic
- Persistence
- Platform
- ESXi
- Version
- 1.0
- Created
- 27 March 2025
- Last modified
- 15 April 2025
- Contributor
- Janantha Marasinghe
Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hypervisors. VIBs are collections of files used for software distribution and virtual system management in VMware environments. Since ESXi uses an in-memory filesystem where changes made to most files are stored in RAM rather than in persistent storage, these modifications are lost after a reboot. However, VIBs can be used to create startup tasks, apply custom firewall rules, or deploy binaries that persist across reboots. Typically, administrators use VIBs for updates and system maintenance.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.vSphere Installation Bundles MITRE reference T1505.006
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
VIRTUALPIES1218 ↗
Has been installed on VMware ESXi servers through malicious vSphere Installation Bundles (VIBs).1
All 1 software entries for this technique
Offense vs defense T1505.006
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1
first rule: 2025 Q3vSphere Installation Bundles detection strategy DET0535
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Abuse of vSphere Installation Bundles (VIBs) for Persistent Access
1 platform
AN1475 · ESXi
Malicious VIB installation for persistence via esxcli software vib install using --force or --no-sig-check, enabling custom startup scripts or firewall rules. Behavior chain: (1) unsigned/suspicious VIB installation → (2) startup script or binary placed in persistent boot path → (3) persistence across reboot via /etc/rc.local.d or other boot hook).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | esxi:esxupdate | /var/log/esxupdate.log contains VIB installed with `--force` or `--no-sig-check` and non-standard acceptance levels |
| File ModificationDC0061 | linux:fim | Changes to /etc/rc.local.d/local.sh or creation of unexpected startup files in persistent partitions (/etc/init.d, /store, /locker) |
| Command ExecutionDC0064 | esxi:shell | `esxcli software vib install` with `--force` or `--no-sig-check` from shell history or `shell.log` |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AcceptanceLevel | Some environments may intentionally permit CommunitySupported or unsigned VIBs—filter by known allowed publishers. |
| InstallCommandThreshold | Set alerting thresholds for frequency of VIB install attempts per host/user/time window. |
| StartupPathRegex | Tune regex for monitoring startup file locations based on ESXi image customization. |
AuditM1047
Periodically audit ESXi hosts to ensure that only approved VIBs are installed. The command esxcli software vib list lists installed VIBs, while the command esxcli software vib signature verify verifies the signatures of installed VIBs.
Boot IntegrityM1046
Enabling secure boot allows ESXi to validate software and drivers during initial system boot.
Code SigningM1045
Enabling the execInstalledOnly feature prevents unsigned binaries from being run on ESXi hosts.