Check Point Security Gateway PHP2Shell Attacks Deploying VMware ESXi Wipers: Detection, Containment, and Remediation

---
title: Check Point Gateway PHP Web Shell Execution
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects PHP process spawning shell commands on Check Point Gaia OS, indicative of PHP2Shell web shell activity.
references:
  - https://attack.mitre.org/techniques/T1505/003/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/php'
      - '/php-cgi'
      - '/httpd'
      - '/apache2'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/perl'
      - '/curl'
      - '/wget'
  condition: selection
falsepositives:
  - Legitimate administrative scripts executed via web interface
level: high
---
title: ESXi SSH Authentication from Check Point Gateway
id: 9e4b3c2d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SSH authentication attempts to ESXi hosts originating from Check Point gateway IP addresses, indicating potential lateral movement.
references:
  - https://attack.mitre.org/techniques/T1021/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.lateral_movement
  - attack.t1021.004
logsource:
  category: network_connection
  product: linux
detection:
  selection_source:
    SourceIp|cidr:
      - '10.0.0.0/8'  # Replace with your Check Point gateway IP ranges
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  selection_destination:
    DestinationPort: 22
    DestinationHostname|contains:
      - 'esxi'
      - 'vmware'
      - 'vsphere'
  condition: selection_source and selection_destination
falsepositives:
  - Legitimate backup or monitoring systems with SSH access to ESXi
level: medium
---
title: ESXi Shell Command Execution for Data Destruction
id: 0f5c4d3e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects shell commands on ESXi hosts associated with wiper deployment, including datastore enumeration and file overwrite patterns.
references:
  - https://attack.mitre.org/techniques/T1485/
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1485
logsource:
  category: process_creation
  product: linux
detection:
  selection_enum:
    CommandLine|contains:
      - 'vim-cmd vmsvc/getallvms'
      - 'esxcli storage filesystem list'
      - 'ls /vmfs/volumes/'
  selection_destroy:
    CommandLine|contains:
      - 'dd if=/dev/zero'
      - 'dd if=/dev/urandom'
      - 'shred'
      - 'wipe'
      - 'rm -rf /vmfs'
      - '> /vmfs/volumes/'
  condition: selection_enum or selection_destroy
falsepositives:
  - Legitimate storage maintenance operations
level: critical

// Hunt for web shell indicators on Check Point gateways
CommonSecurityLog
| where DeviceVendor == "Check Point"
| where DeviceProduct == "VPN-1 & FireWall-1"
| where Activity has_any ("php", "shell", "cmd", "exec")
| where AdditionalExtensions has_any ("wget", "curl", "chmod", "bash", "sh -c")
| project TimeGenerated, SourceIP, DestinationIP, Activity, Message, AdditionalExtensions
| order by TimeGenerated desc

// Correlate Check Point compromise with ESXi authentication attempts
let checkpoint_ips = CommonSecurityLog
    | where DeviceVendor == "Check Point"
    | where Activity contains "accept"
    | distinct SourceIP;
Syslog
| where Computer has_any ("esxi", "vmware")
| where SyslogMessage has_any ("sshd", "Accepted", "password")
| where HostIP in (checkpoint_ips)
| project TimeGenerated, Computer, HostIP, SyslogMessage, ProcessName

// Detect destructive command patterns on ESXi hosts
Syslog
| where Computer has_any ("esxi", "vmware")
| where SyslogMessage has_any ("dd if=", "shred", "rm -rf", "/vmfs/volumes/", "wipefs")
| where SyslogMessage !has_any ("backup", "legitimate-maintenance-script")  // Tune exclusions
| project TimeGenerated, Computer, SyslogMessage, SeverityLevel
| order by TimeGenerated desc

-- Hunt for PHP web shells and suspicious processes on Check Point Gaia OS
SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    ParentPid
FROM pslist()
WHERE 
    (Name =~ 'php|httpd|apache' AND CommandLine =~ 'sh|bash|python|perl|curl|wget')
    OR (CommandLine =~ 'base64|eval|system|exec|shell_exec|passthru')
    OR (Exe =~ '/tmp/|/var/tmp/|/dev/shm/')
ORDER BY CreateTime DESC

-- Check for recently modified PHP files in web directories
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime
FROM glob(globs='/opt/CP*/**/*.php')
WHERE Mtime > ago(7 * 24 * 3600)  -- Files modified in last 7 days
ORDER BY Mtime DESC

#!/bin/bash
# Check Point PHP2Shell & ESXi Wiper Response Script
# Execute from a secured jump host with SSH access to gateways and ESXi

GATEWAYS=("192.168.1.1" "192.168.1.2")  # Update with your gateway IPs
ESXI_HOSTS=("10.0.0.10" "10.0.0.11")   # Update with your ESXi IPs
LOG_FILE="/tmp/checkpoint_esxi_audit_$(date +%Y%m%d_%H%M%S).log"

echo "[+] Starting security audit at $(date)" | tee -a "$LOG_FILE"

# Function to check Check Point gateway
for GW in "${GATEWAYS[@]}"; do
    echo "[*] Auditing Check Point gateway: $GW" | tee -a "$LOG_FILE"
    
    # Check for suspicious PHP files (adjust paths for your Gaia version)
    ssh admin@"$GW" "find /opt/CPshrd-R81.20/ /opt/CPsuite-R81.20/ -name '*.php' -mtime -7 2>/dev/null" | tee -a "$LOG_FILE"
    
    # Check running processes for web shell indicators
    ssh admin@"$GW" "ps aux | grep -E '(php|httpd)' | grep -v grep" | tee -a "$LOG_FILE"
    
    # Verify patch level (command varies by version - consult Check Point sk)
    ssh admin@"$GW" "show installer status" 2>/dev/null | tee -a "$LOG_FILE"
done

# Function to check ESXi hosts
for ESXI in "${ESXI_HOSTS[@]}"; do
    echo "[*] Auditing ESXi host: $ESXI" | tee -a "$LOG_FILE"
    
    # Check for active SSH sessions from non-management IPs
    ssh root@"$ESXI" "esxcli network ip connection list | grep :22" | tee -a "$LOG_FILE"
    
    # Verify SSH is restricted (check /etc/hosts.allow and hosts.deny)
    ssh root@"$ESXI" "cat /etc/hosts.allow /etc/hosts.deny 2>/dev/null" | tee -a "$LOG_FILE"
    
    # Check for suspicious files in /tmp and /vmfs/volumes
    ssh root@"$ESXI" "find /tmp -type f -mtime -3 -ls 2>/dev/null" | tee -a "$LOG_FILE"
    ssh root@"$ESXI" "ls -la /vmfs/volumes/ | head -20" | tee -a "$LOG_FILE"
done

echo "[+] Audit complete. Review $LOG_FILE for findings."
echo "[!] If suspicious PHP files or processes found: isolate gateway immediately and initiate IR procedure."