CrowdStrike Identifies 21 Shell Obfuscation Techniques That Evade VMware ESX Detection

CrowdStrike researchers have documented 21 shell obfuscation techniques that function within VMware ESX's BusyBox environment and successfully bypass plaintext keyword-based detection methods. The techniques — including hex/octal encoding, invisible Unicode characters, XOR-based transformations, and VMFS file masquerading — allow attackers to conceal commands like esxcli from security monitoring tools and SIEM systems. Testing was conducted on ESX 7.0.3, and the research is defensive in nature, with no CVE assigned and no confirmed use of these specific methods in real-world attacks. The findings are relevant given that threat groups such as SCATTERED SPIDER, BlackBasta, and Akira have previously targeted ESX environments after obtaining shell access via stolen credentials or lateral movement. CrowdStrike recommends disabling ESXi Shell and SSH by default, auditing usage strictly, and shifting detection strategies toward identifying obfuscation syntax primitives rather than relying solely on plaintext keyword matching.