« ESXi Host Prepared for an Unsigned Install ESXi Lockdown Mode Disabled »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

ESXi Local Account Created

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Local Account Created

edit

Detects creation of a local ESXi account. A new account is a separate login that remains after the session that created it. It has no rights until a role is assigned, and it is the first step toward a persistent login on the host.

Rule type: query

Rule indices:

  • logs-vsphere.log-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Persistence
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi
  • Threat: Ransomware

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Local Account Created

Hostd records Account <name> was created on host <hostname> when an account is added from the Host Client or API. The shell records esxcli system account add. The new account has no role until a later permission change.

Possible investigation steps

  • Read the account name in message and the user field on the hostd event, which is the account that created it.
  • Look for a following esxcli system permission set or an Admin role grant for the same account.
  • Compare the account with the approved list for that host.

False positive analysis

A documented joiner or break-glass account is commonly benign. An unknown account created by root over the Host Client, then granted Admin, deserves review.

Response and remediation

  • If the account was not approved, remove it with esxcli system account remove --id <name>.
  • Preserve hostd.log and shell.log for the creating session.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit
data_stream.dataset:vsphere.log and event.module:vsphere and message:("esxcli system account add" or Account and "was created")

Framework: MITRE ATT&CKTM

« ESXi Host Prepared for an Unsigned Install ESXi Lockdown Mode Disabled »