VMware vCenter — CVE-2026-59310

What this hunt looks for: Indicators associated with exploitation of CVE-2026-59310, including known artifacts, suspicious cron activity, persistence, and unexpected vCenter administrative account changes.
Required logs: VMware vCenter / VCSA system, authentication, and administrative logs ingested into Microsoft Sentinel as Syslog.

---

Hunt 1 — First-Pass IOC / Artifact Search

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any (
    "zz-poc59310",
    "linuxFile",
    "reverse_ssh",
    "esxi.sh",
    "vmware-perf-update.jsp",
    "vmware-vpxd-stats",
    "vmware-perf-collect",
    "vmware-perf-sync",
    "/etc/sudoers.d/vmware-perf",
    "adminuser",
    "vcadmin",
    ".babyk"
)
| project TimeGenerated, Computer, HostName, HostIP, ProcessName, SyslogMessage
| sort by TimeGenerated asc

Hunt 2 — Suspicious Cron Activity

Syslog
| where TimeGenerated >= ago(30d)
| where ProcessName has_any ("cron", "crond") or SyslogMessage has_any ("CRON", "CROND")
| where SyslogMessage has_any ("curl ", "wget ", "/tmp/", "/etc/cron.d/", "chmod +x", "reverse_ssh", "linuxFile", "esxi.sh")
| project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage
| sort by TimeGenerated asc

Hunt 3 — New or Suspicious vCenter Administrative Accounts

Use where vCenter authentication or administrative audit logs are ingested.

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("adminuser", "vcadmin", "administrator", "SSO", "user created", "account created", "role assigned", "permission assigned")
| project TimeGenerated, Computer, HostName, ProcessName, SyslogMessage
| sort by TimeGenerated asc