« ESXi Firewall Disabled ESXi Host Prepared for an Unsigned Install »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

ESXi Host Logs Deleted with rm

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Host Logs Deleted with rm

edit

Detects a shell rm of a path under /var/log or of a *.log name. Those files hold shell commands, authentication, and hostd activity. Removing them takes away the record of what changed on the host.

Rule type: query

Rule indices:

  • logs-vsphere.log-*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Defense Evasion
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Host Logs Deleted with rm

shell.log records the typed command. The rule matches a line that contains rm together with a /var/log/ path or a *.log name, such as [root]: rm -f /var/log/hostd.log or [root]: rm *.log.

Possible investigation steps

  • Read message and note the path that was deleted.
  • On the host, list /var/log and see which files are missing, including shell.log, auth.log, and hostd.log.
  • Review account changes, firewall changes, and VM power events from the same session that are still in the index.

False positive analysis

Deleting one rotated log during maintenance can be expected. rm *.log removes every log name in the current directory and should be explained by a ticket.

Response and remediation

  • If the delete was not approved, isolate the host and preserve any remaining logs before they rotate.
  • Rotate credentials used in that shell session.
  • Confirm remote syslog still has a copy of the deleted host logs.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit
data_stream.dataset:vsphere.log and event.module:vsphere and message:(rm and ("*.log" or "/var/log/*"))

Framework: MITRE ATT&CKTM

« ESXi Firewall Disabled ESXi Host Prepared for an Unsigned Install »