-
Detects an ESXi account being granted the Administrator role. Administrator is full control of the host, including the firewall, SSH, accounts, and every virtual machine. Granting it to another account keeps that access after the original session ends.
Read More -
Detects an attempt to install a VMware VIB with
--force. A VIB is how ESXi adds drivers and host software, and signature checks normally block an unsigned package.--forceskips that validation, so an untrusted package can be written onto the hypervisor and affect every virtual machine it runs.
Read More -
Detects ESXi audit record transmission being turned off, locally or to a remote collector. Audit records are the host's own trail of administrative changes. Disabling them means later changes to accounts, the firewall, and SSH are not recorded there.
Read More -
Detects
curlorwgetfrom the ESXi shell. These tools download a file or contact a remote URL from the hypervisor. A successful transfer can place a package or script on the host, often under/tmp, where a later command can execute it against the datastore.
Read More -
Detects ESXi ExecInstalledOnly protection being turned off. The setting limits execution to binaries that were installed by a VIB and have not been modified. When it is set to false, the host can run files from paths such as
/tmpthat were never part of the system image.
Read More -
Detects chmod making a file executable on an ESXi host, including
+xand numeric modes such as755and777. The host will not run a file until the execute bit is set. Making a file under/tmpexecutable is the step that lets a later command launch it against the datastore.
Read More -
Detects the ESXi firewall being turned off or switched to a default allow. The firewall is the host filter for management services. Disabling it, or setting the default action to accept, lets later connections reach services that were previously blocked.
Read More -
Detects a shell
rmof a path under/var/logor of a*.logname. Those files hold shell commands, authentication, and hostd activity. Removing them takes away the record of what changed on the host.
Read More -
Detects three changes on the same ESXi host within 1 hour: SSH enabled, ExecInstalledOnly turned off, and a VIB install with
-for--forceand--no-sig-check. Together they open a remote shell, allow unsigned code to run, and bypass VIB signature checks. That sequence prepares the host to receive and run a package the normal controls would reject.
Read More -
Detects creation of a local ESXi account. A new account is a separate login that remains after the session that created it. It has no rights until a role is assigned, and it is the first step toward a persistent login on the host.
Read More -
Detects the disabling of ESXi lockdown mode, a critical security feature that restricts remote access to ESXi hosts. When lockdown mode is disabled, remote users can directly access and modify ESXi host configurations using the root login. When enabled, the ESXi host is accessible only through the local console or vCenter Server.
Read More -
Detects three or more failed ESXi logons for the same account from the same remote address within 10 minutes. Hostd records each failure from
pam_do_authenticatewith the login name andrhost. Repeated failures from one source are password guessing against that account and can lock it or come just before a successful login.
Read More -
Detects a program launched from the ESXi shell against
/vmfs/volumes. The datastore holds the virtual disks of every guest. A process pointed at that path can read or encrypt those disks and take the hosted virtual machines offline.
Read More -
Detects hostd accepting the ESXi root password from a remote address. A successful remote root login opens the Host Client or the API with full control of the host. Local sessions from 127.0.0.1 are left out of the rule.
Read More -
Detects a change to the ESXi root password, the credential for SSH, the Host Client, and the API. Replacing it locks out the previous password and gives the new value full control of the host. Hostd records
Password was changed for account root. The shell recordsesxcli system account set -i root.
Read More -
Detects ESXi shell commands that rebuild a command with encoding instead of writing it in clear text, including octal and hex
printf, Pythonchr(),awk%csequences, reversed strings, and invisible Unicode. The shell log then hides the administrative command. The decoded action can still change syslog, the firewall, or other host settings.
Read More -
Detects ESXi SSH being turned on. SSH is often left disabled so the host is managed through the local console, the Host Client, or vCenter. Enabling it opens a remote shell that can copy files onto the host and run commands against the datastore.
Read More -
Identifies a successful SSH session opened by the privileged vpxuser account. vpxuser is a service account used by VMware vCenter Server to manage ESXi hosts. An SSH session from that account reaches the host shell directly, outside the vCenter management path, and is a sign the credential is being reused with malicious intent.
Read More -
Detects the ESXi remote syslog destination being cleared with
--reset=loghost. The loghost is where host logs are forwarded for retention and detection. Clearing it keeps later commands on the host only, so an external collector stops receiving them.
Read More -
Detects shell commands that collect ESXi host details or the local account list, including
uname -a, system version, hostname, andesxcli system account list. The output identifies the build and the accounts that can log in. Listing accounts shows which identities exist before one of them is changed or used.
Read More -
Detects a shell search under
/vmfs/volumesfor virtual disk and snapshot files (vmdk,vmsn,vmsd). Those files are the guest disks and their on-host recovery points. Listing them builds the set of files a later process can encrypt or delete.
Read More -
Detects
vim-cmd vmsvc/power.offon an ESXi host. Powering a virtual machine off releases the lock the hypervisor holds on its virtual disks. With the guest stopped, those disks can be rewritten or encrypted while the machine is down.
Read More -
Detects termination of a virtual machine process on an ESXi host, including
esxcli vm process kill,pkillofvmxprocesses, andvmdumpersuspend. A running VM holds a lock on its disks. Stopping the process releases that lock and makes the disks writable.
Read More -
Detects
esxcli vm process liston an ESXi host. The command lists running virtual machines and the world IDs of theirvmxprocesses. Those IDs are what a later kill command uses to stop the VMs and release the locks on their virtual disks.
Read More -
Detects removal of all snapshots for an ESXi virtual machine. Snapshots are on-host recovery points for a guest. Removing all of them deletes those recovery points, so the virtual machine cannot be reverted to an earlier disk state.
Read More