ESXi Host Prepared for an Unsigned Install

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Host Prepared for an Unsigned Install

Detects three changes on the same ESXi host within 1 hour: SSH enabled, ExecInstalledOnly turned off, and a VIB install with -f or --force and --no-sig-check. Together they open a remote shell, allow unsigned code to run, and bypass VIB signature checks. That sequence prepares the host to receive and run a package the normal controls would reject.

Rule type: esql

Rule indices: None

Severity: critical

Risk score: 99

Runs every: 5m

Searches indices from: now-1h (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Endpoint
Data Source: VMware vSphere
Use Case: Threat Detection
Tactic: Defense Evasion
Tactic: Lateral Movement
Resources: Investigation Guide
Rule Type: ES|QL
Platform: VMware ESXi

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Host Prepared for an Unsigned Install

The rule counts three behaviors on one host and alerts only when all three occur in the same 1-hour window. SSH enablement is hostsvc/enable_ssh or the hostd sentence SSH access has been enabled. ExecInstalledOnly is the kernel setting set to FALSE, or the advanced setting /User/ExecInstalledOnly set with -i 0. The install is vib install with the -f or --force switch and --no-sig-check.

Possible investigation steps

Read Esql.message_values and confirm each count is at least 1.
Compare Esql.span_minutes with the change window. The three lines should sit close together.
On the host, run esxcli software vib list and look for a VIB that was not part of the approved image.
Check esxcli system settings kernel list -o execInstalledOnly and whether SSH is still enabled.

False positive analysis

Vendor recovery and lab image builds sometimes force a VIB while SSH is open. The VIB name and the ticket should match.

Response and remediation

If the change was not approved, remove the unexpected VIB and set ExecInstalledOnly back to TRUE.
Disable SSH when remote shell access is no longer required.
Preserve shell.log and hostd.log for the host before rotating credentials.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit

FROM logs-vsphere.log-*
| WHERE data_stream.dataset == "vsphere.log" AND event.module == "vsphere" and host.ip is not null
| EVAL Esql.message_lower = TO_LOWER(message)
| EVAL
    Esql.ssh_enabled = CASE(
      Esql.message_lower LIKE "*ssh access has been enabled*" OR Esql.message_lower LIKE "*hostsvc/enable_ssh*",
      1, 0
    ),
    Esql.exec_installed_only_disabled = CASE(
      Esql.message_lower LIKE "*execinstalledonly*" AND (
        Esql.message_lower LIKE "*false*" OR Esql.message_lower LIKE "* -i 0*" OR Esql.message_lower LIKE "* -v 0*"
      ),
      1, 0
    ),
    Esql.vib_force_install = CASE(
      Esql.message_lower LIKE "*vib install*" AND (
        Esql.message_lower LIKE "* -f *" OR Esql.message_lower LIKE "* -f"
        OR Esql.message_lower LIKE "* --force *" OR Esql.message_lower LIKE "* --force"
      ),
      1, 0
    )
| WHERE Esql.ssh_enabled == 1 OR Esql.exec_installed_only_disabled == 1 OR Esql.vib_force_install == 1
| STATS
    Esql.ssh_enabled_count = SUM(Esql.ssh_enabled),
    Esql.exec_installed_only_disabled_count = SUM(Esql.exec_installed_only_disabled),
    Esql.vib_force_install_count = SUM(Esql.vib_force_install),
    Esql.message_values = VALUES(message),
    Esql.log_file_path_values = VALUES(vsphere.log.file.path),
    Esql.first_seen = MIN(@timestamp),
    Esql.last_seen = MAX(@timestamp)
  BY host.ip
| WHERE Esql.ssh_enabled_count > 0
    AND Esql.exec_installed_only_disabled_count > 0
    AND Esql.vib_force_install_count > 0
| KEEP host.ip, Esql.ssh_enabled_count, Esql.exec_installed_only_disabled_count, Esql.vib_force_install_count,
    Esql.message_values, Esql.log_file_path_values, Esql.first_seen, Esql.last_seen

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Technique:
- Name: Impair Defenses
- ID: T1562
- Reference URL: https://attack.mitre.org/techniques/T1562/
Sub-technique:
- Name: Disable or Modify Tools
- ID: T1562.001
- Reference URL: https://attack.mitre.org/techniques/T1562/001/
Technique:
- Name: Subvert Trust Controls
- ID: T1553
- Reference URL: https://attack.mitre.org/techniques/T1553/
Sub-technique:
- Name: Code Signing Policy Modification
- ID: T1553.006
- Reference URL: https://attack.mitre.org/techniques/T1553/006/
Tactic:
- Name: Lateral Movement
- ID: TA0008
- Reference URL: https://attack.mitre.org/tactics/TA0008/
Technique:
- Name: Remote Services
- ID: T1021
- Reference URL: https://attack.mitre.org/techniques/T1021/
Sub-technique:
- Name: SSH
- ID: T1021.004
- Reference URL: https://attack.mitre.org/techniques/T1021/004/

« ESXi Host Logs Deleted with rm ESXi Local Account Created »