T1505.006sub-technique of T1505 Server Software Component
vSphere Installation Bundles
ESXinothing on this site yetT1505.006 on attack.mitre.org
Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hypervisors. VIBs are collections of files used for software distribution and virtual system management in VMware environments. Since ESXi uses an in-memory filesystem where changes made to most files are stored in RAM rather than in persistent storage, these modifications are lost after a reboot.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Detect Abuse of vSphere Installation Bundles (VIBs) for Persistent Access
- Malicious VIB installation for persistence via `esxcli software vib install` using `--force` or `--no-sig-check`, enabling custom startup scripts or firewall rules.
what reduces it
- M1045 Code Signing. Enabling the `execInstalledOnly` feature prevents unsigned binaries from being run on ESXi hosts.
- M1046 Boot Integrity. Enabling secure boot allows ESXi to validate software and drivers during initial system boot.
- M1047 Audit. Periodically audit ESXi hosts to ensure that only approved VIBs are installed. The command `esxcli software vib list` lists installed VIBs, while the command `esxcli software vib signature verify` verifies the signatures of installed VIBs.