T1505.006 — vSphere Installation Bundles

Tactic: Persistence · Platforms: ESXi

Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hypervisors. VIBs are collections of files used for software distribution and virtual system management in VMware environments. Since ESXi uses an in-memory filesystem where changes made to most files…

Sub-technique of Server Software Component (T1505).

Sigma detection rules (1)

T1505.006 Server Software Component: vSphere Installation Bundles

title: "T1505.006 Server Software Component: vSphere Installation Bundles"
id: e018a92a-e532-41a0-a484-e114b3b84255
description: 'Detect Abuse of vSphere Installation Bundles (VIBs) for Persistent Access. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AcceptanceLevel, InstallCommandThreshold, StartupPathRegex.'
references:
  - https://attack.mitre.org/techniques/T1505/006
author: Shahrukh Khan
date: 2026-06-20
license: MIT
tags:
  - attack.persistence
  - attack.t1505.006

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection_install:
    CommandLine|contains: 'esxcli software vib install'
  selection_unsigned:
    CommandLine|contains:
      - '--no-sig-check'
      - '--force'
      - 'CommunitySupported'
      - 'PartnerSupported'

  condition: selection_install and selection_unsigned

falsepositives:
  - Legitimate installation of a community-supported driver or vendor VIB during hardware bring-up; verify AcceptanceLevel changes and StartupPathRegex of the installed package against known-good vendor packages before escalating.

level: critical

Related sub-techniques

Explore