ESXi Account Granted Admin Role

Detects an ESXi account being granted the Administrator role. Administrator is full control of the host, including the firewall, SSH, accounts, and every virtual machine. Granting it to another account keeps that access after the original session ends.

Rule type: query
Rule indices:

  • logs-vsphere.log-*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Persistence
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Admin on a standalone ESXi host can change the firewall, syslog, SSH, and every virtual machine. Granting that role to an unexpected account is a persistence path that survives the interactive session.

  • Read the account name in message. The shell form uses --id. The hostd form is Permission created for <name>.
  • Compare that name with known ESXi accounts (root, dcui, vpxuser, and approved operators).
  • Look for a preceding Account <name> was created or esxcli system account add for the same id.
  • Check whether that account was used for SSH or further esxcli commands.

Joiner automation and break-glass account setup grant Admin on purpose. The account id should match a ticket.

  • If the account is unknown, remove the permission and the account: esxcli system permission unset and esxcli system account remove.
  • Rotate credentials that were exposed in the same session.
  • Hunt other hosts for the same account id.
data_stream.dataset:vsphere.log and event.module:vsphere and message:("system permission set" and ("--role Admin" or "--role=Admin") or "Permission created" and "role is Administrator")

Framework: MITRE ATT&CK