TLDR Tech / InfoSec
Goblin Loot: Proxmox and Adversaries
As Proxmox displaces VMware in many shops, this detection-engineering walkthrough outlines how adversaries operate on PVE nodes: enumerating realms via an unauthenticated GET to /api2/json/access/domains/, brute-forcing accounts, then living off the land with pvesh to enumerate or destroy guest VMs and abusing IP sets in /etc/pve/firewall/cluster.fw to lock responders out. pvesh activity never reaches the pveproxy audit trail and is visible only through process execution and journald, so defenders should model normal PVE CLI usage by SSH-session lineage, command diversity, and invocation directory, and deploy AuditD watches keyed to executables under /usr/sbin and /usr/bin (qm, pct, pvecm, pvesm, pveum, and pvesh) plus writes to /etc/pve/ and /usr/share/perl5/PVE/. Collect the pveproxy access log, along with the named systemd units (pvedaemon, pve-cluster, pveproxy, pvefw-logger, proxmox-firewall, and related services), via journald to close the gaps left by GUI-routed and cluster tasks.
Read the full story