Unfortunately for defenders, ESXi hosts themselves do not currently support natively run EDR endpoint detection and response. If logging is enabled, certain events on those hosts can be forwarded to a SIEM, but this workaround is less than ideal for a variety of reasons. This gap in protection has not gone unnoticed by attackers. In particular, all too many ransomware attacks over the years have exploited this issue.
The Sophos Managed Risk team regularly fields questions about insecure host configurations, and provides guidance for how those can be remediated. Where appropriate, we describe and link to the most current instructions available, which are generally maintained by VMware Broadcom itself.
What make ESXi hosts so attractive to attackers? Think like an attacker applies here: Why deal with EDR, and potentially even MDR managed detection and response , by attacking the VMs themselves, when you can just duck all those protections and target the underlying, insecurely configured host? By targeting the host, an attacker can quickly do a disproportionate amount of damage to an organization β encrypting an entire ESXi host, along with the VMs it is hosting, literally with one click.
For some organizations, an attacker might potentially still wreak havoc, and command a ransom payment, if they only encrypt the ESXi infrastructure.
Fortunately, there are things defenders can do to interfere with an attack on ESXi. At minimum, these precautions slow attackers down giving defenders more opportunity to detect and respond , and they may even succeed in stopping the attack against ESXi altogether. This article covers ten tactics, with links to source materials and additional information where appropriate. In no particular order:.
