AN0646
Analytic 0646
ESXi
Detects anomalous usage of ESXi Guest Operations APIs such as StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, or InitiateFileTransferFromGuest. Defender perspective focuses on unusual frequency of guest API calls, invocation from unexpected management accounts, or execution outside of business hours. These correlated signals indicate adversarial abuse of ESXi administrative services to run commands on guest VMs.
esxi:hostd
Guest Operations API invocation: StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, InitiateFileTransferFromGuest
[ExpectedAdminUsers]
Whitelist of management accounts authorized to use ESXi Guest Ops APIs.
[TimeWindow]
Business hours during which Guest Ops API usage is expected; activity outside may be suspicious.
[OperationThreshold]
Number of Guest Ops API calls considered anomalous if exceeded in a given timeframe.
[AuthorizedVMs]
List of VMs where Guest Ops usage is permitted; usage on other VMs may indicate malicious activity.