« ESXI Timestomping using Touch Command ESXi Attempt to Force Install a VMware VIB Package »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

ESXi Account Granted Admin Role

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Account Granted Admin Role

edit

Detects an ESXi account being granted the Administrator role. Administrator is full control of the host, including the firewall, SSH, accounts, and every virtual machine. Granting it to another account keeps that access after the original session ends.

Rule type: query

Rule indices:

  • logs-vsphere.log-*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Persistence
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Account Granted Admin Role

Admin on a standalone ESXi host can change the firewall, syslog, SSH, and every virtual machine. Granting that role to an unexpected account is a persistence path that survives the interactive session.

Possible investigation steps

  • Read the account name in message. The shell form uses --id. The hostd form is Permission created for <name>.
  • Compare that name with known ESXi accounts (root, dcui, vpxuser, and approved operators).
  • Look for a preceding Account <name> was created or esxcli system account add for the same id.
  • Check whether that account was used for SSH or further esxcli commands.

False positive analysis

Joiner automation and break-glass account setup grant Admin on purpose. The account id should match a ticket.

Response and remediation

  • If the account is unknown, remove the permission and the account: esxcli system permission unset and esxcli system account remove.
  • Rotate credentials that were exposed in the same session.
  • Hunt other hosts for the same account id.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit
data_stream.dataset:vsphere.log and event.module:vsphere and message:("system permission set" and ("--role Admin" or "--role=Admin") or "Permission created" and "role is Administrator")

Framework: MITRE ATT&CKTM

« ESXI Timestomping using Touch Command ESXi Attempt to Force Install a VMware VIB Package »