Open cardosec

Case 35ADBE · Blue team / DFIR · L5 Expert

Hypervisors Encrypted, EDR Silent

Practise as: Incident drill · Deep dive

Live alertAt 04:20 dozens of VMs drop offline at once; vCenter shows SSH enabled overnight on every ESXi host and .vmdk files renamed with a new extension, yet guest EDR saw nothing.

  1. 01 What happened?
  2. 02 What is the impact?
  3. 03 What do you do?
Practise this card As Deep dive
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Encryption at the hypervisor bypasses guest EDR entirely; assume the actor holds vCenter or ESXi root, often via AD-linked admin rights.
  2. ESXi logs (hostd.log, shell.log, auth.log) may sit on a ramdisk; pull them or syslog copies before any host reboot.
  3. Trace the path in: vCenter events, AD changes (e.g. ESX Admins group abuse, CVE-2024-37085), and stolen vSphere admin creds.
  4. Treat the virtualization layer as untrusted: reinstall ESXi with new creds and restore from immutable backups, not in place.
  5. Harden: lockdown mode, SSH off, execInstalledOnly, MFA on vCenter, and no ESXi admin granted through AD groups.

If the interviewer pushes back

  • How would you isolate the vSphere management plane so a full AD compromise cannot reach the hypervisors?
  • The .vmdk files were only partially encrypted. What evidence of earlier attacker activity can you still recover from the guests?

Go deeper

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.