ESXi SSH Access Enabled

Detects ESXi SSH being turned on. SSH is often left disabled so the host is managed through the local console, the Host Client, or vCenter. Enabling it opens a remote shell that can copy files onto the host and run commands against the datastore.

Rule type: query
Rule indices:

  • logs-vsphere.log-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Lateral Movement
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

SSH is disabled on many ESXi hosts. Turning it on is the step that lets an intruder who already has the root password open a shell and stage a payload in /tmp.

  • Confirm whether the hit is the hostd sentence SSH access has been enabled or the shell command hostsvc/enable_ssh.
  • Review source.ip and the account on nearby authentication events.
  • Check for a following cd /tmp, file upload, or vm process command.
  • Ask whether a change ticket opened SSH on this host.

Documented troubleshooting enables SSH and should disable it afterward. An enable with no ticket, followed by datastore commands, is the intrusion pattern.

  • If the enable was not approved, disable SSH (vim-cmd hostsvc/disable_ssh) after preserving logs.
  • Rotate the root password and review accounts added in the same window.
  • Hunt other hosts for the same hostd event.
data_stream.dataset:vsphere.log and message:("SSH access has been enabled" or "hostsvc/enable_ssh")

Framework: MITRE ATT&CK