« ESXi SSH Access Enabled ESXi Shell Command Obfuscation »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

ESXi SSH Session from vpxuser

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi SSH Session from vpxuser

edit

Identifies a successful SSH session opened by the privileged vpxuser account. vpxuser is a service account used by VMware vCenter Server to manage ESXi hosts. An SSH session from that account reaches the host shell directly, outside the vCenter management path, and is a sign the credential is being reused with malicious intent.

Rule type: query

Rule indices:

  • logs-vsphere.log-*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Lateral Movement
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi SSH Session from vpxuser

Hostd records SSH session was opened for vpxuser@<address> when that account gets a shell. vpxuser is created for vCenter and is not an interactive operator account.

Possible investigation steps

  • Read the address after vpxuser@ in message and compare it with the vCenter server.
  • Review shell commands in the same session, especially copies to /tmp, vm process, and datastore paths.
  • Check whether SSH was enabled on this host just before the session.
  • Ask whether anyone used vpxuser for a documented console session.

False positive analysis

An approved break-glass SSH session with vpxuser should be rare and tied to a ticket. A session from an address that is not the vCenter server deserves review.

Response and remediation

  • If the session was not approved, disable SSH and terminate the session.
  • Rotate the vpxuser credential from vCenter and review other hosts for the same account.
  • Preserve hostd.log and shell.log for the session.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit
data_stream.dataset:vsphere.log and event.module:vsphere and message:("SSH session was opened for" and vpxuser)

Framework: MITRE ATT&CKTM

« ESXi SSH Access Enabled ESXi Shell Command Obfuscation »