« ESXi Payload Executed Against Datastore ESXi Root Password Changed »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

ESXi Root Password Accepted from Remote Host

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Root Password Accepted from Remote Host

edit

Detects hostd accepting the ESXi root password from a remote address. A successful remote root login opens the Host Client or the API with full control of the host. Local sessions from 127.0.0.1 are left out of the rule.

Rule type: query

Rule indices:

  • logs-vsphere.log-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Initial Access
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi
  • Threat: Ransomware

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Root Password Accepted from Remote Host

Vimsvc.HaSessionManager writes this line when a root password is accepted. The source after from is the client address. A remote address is a direct HTTPS login to the host. from 127.0.0.1 is local esxcli and is not part of this rule. vpxuser from 127.0.0.1 is the host’s own client.

Possible investigation steps

  • Read the source address in message. Compare it with known admin workstations.
  • In the same sid and opID, look for the following User root@<ip> logged in event and for SSH access has been enabled.
  • Check later shell commands for chmod, /tmp, and /vmfs/volumes.

False positive analysis

A documented Host Client login as root from the admin network can be benign. A root acceptance from an unexpected address, followed by SSH being enabled, is the lateral-movement pattern.

Response and remediation

  • If the source was not approved, disable the session, rotate the root password, and review accounts created in that window.
  • Preserve hostd.log for the sid on the event.
  • Hunt other hosts for Accepted password for user root from the same source address.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit
data_stream.dataset:vsphere.log and event.module:vsphere and message:("Accepted password for user root" and not "from 127.0.0.1")

Framework: MITRE ATT&CKTM

« ESXi Payload Executed Against Datastore ESXi Root Password Changed »