CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX
CrowdStrike, Friday, August 7th, 2026
CrowdStrike catalogs 21 shell command obfuscation techniques on VMware ESX and builds regex detections.
CrowdStrike researchers tested shell command obfuscation techniques against a VMware ESX environment.
They cataloged 21 distinct methods attackers can use to disguise commands from logging and detection. The team then built regex-based detection patterns derived from that research.
The work matters because ESX systems are a recurring target in ransomware campaigns, including by groups such as SCATTERED SPIDER.