« ESXi Root Password Changed ESXi SSH Session from vpxuser »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

ESXi SSH Access Enabled

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi SSH Access Enabled

edit

Detects ESXi SSH being turned on. SSH is often left disabled so the host is managed through the local console, the Host Client, or vCenter. Enabling it opens a remote shell that can copy files onto the host and run commands against the datastore.

Rule type: query

Rule indices:

  • logs-vsphere.log-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Lateral Movement
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi SSH Access Enabled

SSH is disabled on many ESXi hosts. Turning it on is the step that lets an intruder who already has the root password open a shell and stage a payload in /tmp.

Possible investigation steps

  • Confirm whether the hit is the hostd sentence SSH access has been enabled or the shell command hostsvc/enable_ssh.
  • Review source.ip and the account on nearby authentication events.
  • Check for a following cd /tmp, file upload, or vm process command.
  • Ask whether a change ticket opened SSH on this host.

False positive analysis

Documented troubleshooting enables SSH and should disable it afterward. An enable with no ticket, followed by datastore commands, is the intrusion pattern.

Response and remediation

  • If the enable was not approved, disable SSH (vim-cmd hostsvc/disable_ssh) after preserving logs.
  • Rotate the root password and review accounts added in the same window.
  • Hunt other hosts for the same hostd event.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit
data_stream.dataset:vsphere.log and message:("SSH access has been enabled" or "hostsvc/enable_ssh")

Framework: MITRE ATT&CKTM

« ESXi Root Password Changed ESXi SSH Session from vpxuser »