ESXi SSH Session from vpxuser

Identifies a successful SSH session opened by the privileged vpxuser account. vpxuser is a service account used by VMware vCenter Server to manage ESXi hosts. An SSH session from that account reaches the host shell directly, outside the vCenter management path, and is a sign the credential is being reused with malicious intent.

Rule type: query
Rule indices:

  • logs-vsphere.log-*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Lateral Movement
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Hostd records SSH session was opened for 'vpxuser@<address>' when that account gets a shell. vpxuser is created for vCenter and is not an interactive operator account.

  • Read the address after vpxuser@ in message and compare it with the vCenter server.
  • Review shell commands in the same session, especially copies to /tmp, vm process, and datastore paths.
  • Check whether SSH was enabled on this host just before the session.
  • Ask whether anyone used vpxuser for a documented console session.

An approved break-glass SSH session with vpxuser should be rare and tied to a ticket. A session from an address that is not the vCenter server deserves review.

  • If the session was not approved, disable SSH and terminate the session.
  • Rotate the vpxuser credential from vCenter and review other hosts for the same account.
  • Preserve hostd.log and shell.log for the session.
data_stream.dataset:vsphere.log and event.module:vsphere and message:("SSH session was opened for" and vpxuser)

Framework: MITRE ATT&CK