Source: GitHub
Author: unknown
URL: https://github.com/CrowdStrike/VirtualGHOST
ONE SENTENCE SUMMARY: The repository provides a PowerShell script (Detect-VirtualGHOST.ps1) using VMWare PowerCLI to detect unregistered, powered-on VMware VMs (“VirtualGHOSTs”) that evade standard management processes.
MAIN POINTS:
- VirtualGHOST refers to VMware VMs powered on manually via command line, not registered in inventory.
- Detect-VirtualGHOST.ps1 script identifies VirtualGHOST VMs by comparing inventory and active VM lists.
- Script requires “Server” (IP/DNS) and “Credential” parameters for VMware API access.
- If parameters aren’t provided initially, the script interactively prompts for necessary inputs.
- Positive detection results list hypervisor, VM name, VM configuration file, and VMWorldID clearly.
- Script alerts on network connections associated with detected VirtualGHOST VMs, including MAC addresses.
- Negative results explicitly indicate no unregistered VMs were found on checked hypervisors.
- VirtualGHOSTs evade standard VMware management tools like vCenter and ESXi web UI.
- For forensic analysis, SSH into ESXi host and manually copy VM files due to locked resources.
- VMware logs (vmware*.log) from VM directories are critical resources for further investigation.
TAKEAWAYS:
- Regularly run Detect-VirtualGHOST.ps1 to proactively identify hidden VMware VMs in your environment.
- Treat any positive result seriously, even though some false positives from normal lifecycle activities may occur.
- Always preserve VM files and vmware logs immediately following discovery for forensic analysis.
- Registration and suspension of a detected VirtualGHOST VM via ESXi web UI facilitates investigative documentation.
- Engage with community via GitHub issues for script support, as official CrowdStrike support isn’t available.