.. /ps

Star

List process information from an ESXi host.

• https://www.levelblue.com/blogs/spiderlabs-blog/19-shades-of-lockbit5.0-inside-the-latest-cross-platform-ransomware-part-1

Lists VMs

1. Gets a list of VM guest processes.

   ps | grep vmx | grep "%s" | grep -v grep | awk '{print $2}' | sort -u

   Use case

   An adversary obtains list of all running processes and filters it to only get those related to guest VMs.

   Privileges required

   Administrator

   Operating systems

   ESXi

   ATT&CK® technique

   T1082

   
   

   Tags

   E-Crime: Lockbit

   A RaaS who utilises initial access brokers to gain access to victims. Reported to targets critical infrastructure sectors, financial services, transportation, food and agriculture, education, energy, government and emergency services