ESXi Syslog Remote Host Reset

Detects the ESXi remote syslog destination being cleared with --reset=loghost. The loghost is where host logs are forwarded for retention and detection. Clearing it keeps later commands on the host only, so an external collector stops receiving them.

Rule type: query
Rule indices:

  • logs-vsphere.log-*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Defense Evasion
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Remote syslog is often the only copy of ESXi shell history that leaves the host. --reset=loghost drops that destination. Obfuscated commands in the same reports decode to this exact esxcli line.

  • Read message for a literal esxcli line or an obfuscated line that still contains reset=loghost.
  • Run or review esxcli system syslog config get and confirm whether Remote Host is empty.
  • Correlate with firewall, SSH, and VM shutdown commands from the same session.

Collector migrations reset the old loghost and then set a new one. An empty loghost that stays empty is not a migration.

  • Restore the collector: esxcli system syslog config set --loghost=<collector> and reload syslog.
  • Pull local shell.log, hostd.log, and auth.log before they rotate. The gap while loghost was empty will be missing from the collector.
  • If the reset was unauthorized, isolate the host.
data_stream.dataset:vsphere.log and message:("syslog config set" and ("--reset loghost" or "--reset=loghost" or "reset=loghost"))

Framework: MITRE ATT&CK