« ESXi Shell Command Obfuscation ESXi System and Account Enumeration »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

ESXi Syslog Remote Host Reset

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Syslog Remote Host Reset

edit

Detects the ESXi remote syslog destination being cleared with --reset=loghost. The loghost is where host logs are forwarded for retention and detection. Clearing it keeps later commands on the host only, so an external collector stops receiving them.

Rule type: query

Rule indices:

  • logs-vsphere.log-*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Defense Evasion
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Syslog Remote Host Reset

Remote syslog is often the only copy of ESXi shell history that leaves the host. --reset=loghost drops that destination. Obfuscated commands in the same reports decode to this exact esxcli line.

Possible investigation steps

  • Read message for a literal esxcli line or an obfuscated line that still contains reset=loghost.
  • Run or review esxcli system syslog config get and confirm whether Remote Host is empty.
  • Correlate with firewall, SSH, and VM shutdown commands from the same session.

False positive analysis

Collector migrations reset the old loghost and then set a new one. An empty loghost that stays empty is not a migration.

Response and remediation

  • Restore the collector: esxcli system syslog config set --loghost=<collector> and reload syslog.
  • Pull local shell.log, hostd.log, and auth.log before they rotate. The gap while loghost was empty will be missing from the collector.
  • If the reset was unauthorized, isolate the host.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit
data_stream.dataset:vsphere.log and message:("syslog config set" and ("--reset loghost" or "--reset=loghost" or "reset=loghost"))

Framework: MITRE ATT&CKTM

« ESXi Shell Command Obfuscation ESXi System and Account Enumeration »