ESXi Root Password Accepted from Remote Host

Detects hostd accepting the ESXi root password from a remote address. A successful remote root login opens the Host Client or the API with full control of the host. Local sessions from 127.0.0.1 are left out of the rule.

Rule type: query
Rule indices:

  • logs-vsphere.log-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Initial Access
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi
  • Threat: Ransomware

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Vimsvc.HaSessionManager writes this line when a root password is accepted. The source after from is the client address. A remote address is a direct HTTPS login to the host. from 127.0.0.1 is local esxcli and is not part of this rule. vpxuser from 127.0.0.1 is the host's own client.

  • Read the source address in message. Compare it with known admin workstations.
  • In the same sid and opID, look for the following User root@<ip> logged in event and for SSH access has been enabled.
  • Check later shell commands for chmod, /tmp, and /vmfs/volumes.

A documented Host Client login as root from the admin network can be benign. A root acceptance from an unexpected address, followed by SSH being enabled, is the lateral-movement pattern.

  • If the source was not approved, disable the session, rotate the root password, and review accounts created in that window.
  • Preserve hostd.log for the sid on the event.
  • Hunt other hosts for Accepted password for user root from the same source address.
data_stream.dataset:vsphere.log and event.module:vsphere and message:("Accepted password for user root" and not "from 127.0.0.1")

Framework: MITRE ATT&CK