ESXi System and Account Enumeration

Detects shell commands that collect ESXi host details or the local account list, including uname -a, system version, hostname, and esxcli system account list. The output identifies the build and the accounts that can log in. Listing accounts shows which identities exist before one of them is changed or used.

Rule type: query
Rule indices:

  • logs-vsphere.log-*

Rule Severity: low
Risk Score: 21
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Discovery
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi
  • Threat: Ransomware

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

These commands collect the OS build, product version, hostname, or the local account list. Account listing is the higher-interest command. Version and hostname checks are common on their own.

  • Read message to see which command ran.
  • Check the same session for vm process list, vm process kill, chmod, or a search under /vmfs/volumes.
  • For esxcli system account list, compare the listed accounts with the known set for that host.

A single version or hostname check during maintenance is commonly benign. Several of these commands in one session, especially account listing followed by VM shutdown, deserves review.

  • If the same session kills virtual machines or writes a file under /tmp, isolate the host.
  • Otherwise record the account and source for hunting on other hosts.
data_stream.dataset: "vsphere.log" and event.module: "vsphere" and
message: (
  "uname -a" or
  "esxcli system version get" or
  "esxcli system hostname get" or
  "esxcli system account list"
)

Framework: MITRE ATT&CK