ESXi Root Password Changed

Detects a change to the ESXi root password, the credential for SSH, the Host Client, and the API. Replacing it locks out the previous password and gives the new value full control of the host. Hostd records Password was changed for account root. The shell records esxcli system account set -i root.

Rule type: query
Rule indices:

  • logs-vsphere.log-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Persistence
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

The root account is the local administrator on a standalone ESXi host. A password change keeps the same account and replaces the credential used for SSH, the Host Client, and the API.

  • Read message for Password was changed for account root or esxcli system account set -i root.
  • Note the account in the hostd user field. That is who performed the change.
  • Check the same session for lockdown mode being disabled, a new local account, or an Admin role grant.
  • Ask whether the new password was recorded in the approved secret store.

A documented root password rotation is commonly benign. An unplanned change, especially after lockdown mode was disabled, deserves review.

  • If the change was not approved, set a new root password and store it with the break-glass process.
  • Review other account and permission changes from the same session.
  • Preserve hostd.log and shell.log before closing the session.
data_stream.dataset:vsphere.log and event.module:vsphere and message:("Password was changed for account root" or "-i root" and "esxcli system account set")

Framework: MITRE ATT&CK