vSphere Installation Bundles (VIBs) are the packaging format administrators use to update ESXi and add drivers or tools. MITRE tracks their abuse as T1505.006 in the Persistence tactic. The only platform listed is ESXi.
The technique exists because of how ESXi works. It uses an in memory filesystem, so changes to most files live in RAM and vanish at reboot. That is a natural obstacle to persistence. VIBs get around it, because they can create startup tasks, apply custom firewall rules or deploy binaries that survive a reboot.
How attackers use it
MITRE breaks a VIB into three parts:
- Payload: a .vgz archive with the files and directories to create and run at boot.
- Signature file: records the acceptance level, which says what testing and validation VMware or a partner did before publishing. By default ESXi requires at least PartnerSupported.
- XML descriptor: metadata such as the VIB name and its dependencies.
The acceptance level is a control, but MITRE points out its limits. A privileged user can change the host acceptance level with esxcli, and a VIB can be installed regardless of its level by using the force option of the install command.
According to MITRE, adversaries use malicious VIBs so that system changes run at each boot: using esxcli to enable firewall rules for backdoor traffic, creating listeners on hard coded ports, and running backdoors. They may also disguise a malicious VIB as PartnerSupported by editing the XML descriptor. MITRE's page names UNC3886 as a group that has used VIBs to install malware and persist on ESXi hypervisors, and lists VIRTUALPIE as malware installed that way.
How to detect it
MITRE's detection strategy describes a behavior chain:
- An unsigned or suspicious VIB is installed, using the force option or the option that skips signature checks.
- A startup script or binary is placed in a persistent boot path.
- Persistence across reboot follows, through a boot hook such as /etc/rc.local.d.
Practical signals:
- Shell and esxcli command history on ESXi hosts that shows VIB installs, especially forced ones.
- Any VIB that is not in your approved list.
- Changes to the host acceptance level.
- New files in boot hook locations.
- New listeners or firewall rules on the host that no change ticket explains.
Forward ESXi shell and host logs to a central system, since a compromised host can lose local evidence.
How to reduce the risk
MITRE lists three mitigations:
- Audit. Periodically audit ESXi hosts so only approved VIBs are installed. MITRE names two commands for this: one lists installed VIBs, the other verifies their signatures.
- Boot Integrity. Enable secure boot so ESXi validates software and drivers during boot.
- Code Signing. Enable the execInstalledOnly feature, which prevents unsigned binaries from running on ESXi hosts.
Support these with access control. Limit who can use the ESXi shell and esxcli, keep SSH disabled when not needed, and keep the host acceptance level at its default or stricter.
Check your own environment
These read only commands run in the ESXi shell and follow what MITRE names:
esxcli software vib list
esxcli software vib signature verify
esxcli software acceptance get
esxcli system settings kernel list -o execInstalledOnly
Review the output:
- Is every VIB on the list one you installed on purpose?
- Does signature verification report any VIB as unsigned or failed?
- Is the acceptance level what your standard says?
- Is execInstalledOnly enabled?
- Is secure boot on for every host?
Save a baseline per host build so the next audit is a comparison, not a fresh investigation.
Quick check
Why do VIBs matter for ESXi persistence specifically?
ESXi keeps most changes in memory, so they are lost at reboot. VIBs can create startup tasks, firewall rules and binaries that persist across reboots.
Is the PartnerSupported acceptance level enough on its own?
No. MITRE notes that privileged users can lower the acceptance level, VIBs can be installed regardless of level with a force option, and adversaries may edit the XML descriptor to pose as PartnerSupported. Audit installed VIBs and verify their signatures as well.
