Guide Outlines Defenses Against BRICKSTORM Activity Targeting VMware vSphere

Apr 2, 2026 · Original article ↗

Summary

The guide presents four phases for hardening vCenter and ESXi against BRICKSTORM activity: baseline controls, privileged identity protections, network segmentation, and forensic visibility using Photon OS firewalls, auditd, AIDE, and remote logging.

Key points

The guide describes BRICKSTORM operations as targeting the VCSA and ESXi control plane, where attackers can persist below guest operating systems and access virtual disks.
Its four-phase program covers baseline controls, privileged identity management, vSphere network hardening, and logging and forensic visibility.
It recommends limiting administrative access to privileged access workstations, using privileged access management, enforcing least privilege, and restricting ESXi shell access for vpxuser on ESXi 8.0 and later.
Recommended network controls include isolating management networks and applying restrictive ingress and egress rules, alongside Photon OS host-firewall rules that log denied connections.
The guide recommends VM encryption, encrypted vMotion, vTPM and Secure Boot, separate key management for Tier-0 workloads, and restricting clone and export privileges.
It advises forwarding auditd events and system logs off-appliance over TLS, and using AIDE file-integrity monitoring to identify unauthorized changes.
It recommends correlating vCenter events, identity activity, auditd records, AIDE alerts, and firewall logs in a SIEM to detect suspicious account changes, persistence modifications, cloning, and probing.

Article Details

Defense Focus: Harden and monitor the vSphere control plane and underlying Photon OS against persistent BRICKSTORM operations and unauthorized access to virtual machine data.
Detection Methods: Correlate host firewall drops with failed SSO logins from the same source IP.
Alert on rapid SSO account creation and deletion, SSH enablement, and changes to BashShellAdministrators membership.
Monitor auditd execution and privilege events for unauthorized binaries, sudo use, startup-script modification, RPM execution, and SSH key changes.
Compare critical files against an AIDE integrity baseline and alert on AIDE_TRAP events.
Investigate VM cloning, disk hot-plugging, unauthorized network adapter additions, and unregistered VM execution.
Inspect Tomcat audit logs for requests to the manager deployment endpoint associated with malicious WAR deployment.
Data Sources: vCenter application and SSO audit events
Photon OS auditd syscall logs
AIDE integrity alerts
Host firewall and network device logs
VAMI access logs
ESXi hostd and shell logs
Tomcat audit logs
Windows network logon events
Rule Types: auditd syscall and file-watch rules
AIDE file integrity rules
iptables firewall logging rules
SIEM correlation rules
Platforms: Linux
Virtualization control plane
Defensive Actions: Enforce MFA, privileged access workstations, credential rotation, and restricted break-glass accounts.
Disable unnecessary SSH access and restrict management interfaces to authorized sources.
Segment management, guest, storage, and vMotion networks; enforce restrictive ingress and egress filtering.
Enable VM and vMotion encryption, isolate Tier-0 encryption keys, and remove clone and export privileges from standard administrator roles.
Forward auditd, firewall, identity, and management events to a protected remote SIEM using TLS and validated certificates.
Maintain an off-host AIDE baseline, schedule integrity checks, and test rules before production deployment.
Synchronize timestamps and retain remote logs for at least 400 days, as recommended by the source.