---
id: 6136
title: "CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX"
source_domain: crowdstrike.com
source_url: "https://www.crowdstrike.com/en-us/blog/crowdstrike-hunts-for-shell-command-obfuscation-vmware-esx/"
published_at: "2026-08-07T00:00:00Z"
tags: ["threat-detection", "detection-engineering", "ransomware", "command-obfuscation", "threat-hunting", "vmware-esxi", "crowdstrike", "vmware-esx"]
phying_url: "https://phying.com/item/6136"
lang: en
---

# CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX

## Summary

CrowdStrike cataloged 21 command obfuscation methods on VMware ESX's BusyBox shell—ciphers, keyed payloads, alternative encodings—and built CQL detections; ESX logs capture commands pre-expansion.

## Intelligence Metadata

- **Sources:** crowdstrike.com
- **Published:** 2026-08-07T00:00:00Z
- **Original:** https://www.crowdstrike.com/en-us/blog/crowdstrike-hunts-for-shell-command-obfuscation-vmware-esx/
- **Phying News:** https://phying.com/item/6136