ESXi Multiple Logon Failures by User and Source

  1[metadata]
  2creation_date = "2026/09/30"
  3integration = ["vsphere"]
  4maturity = "production"
  5updated_date = "2026/09/30"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects three or more failed ESXi logons for the same account from the same remote address within 10 minutes.
 11Hostd records each failure from `pam_do_authenticate` with the login name and `rhost`. Repeated failures from
 12one source are password guessing against that account and can lock it or come just before a successful login.
 13"""
 14false_positives = [
 15    """
 16    An administrator who mistypes the root password in the Host Client a few times can reach three failures.
 17    Confirm the source address is a known workstation and that a successful login did not follow.
 18    """,
 19]
 20from = "now-9m"
 21language = "esql"
 22license = "Elastic License v2"
 23name = "ESXi Multiple Logon Failures by User and Source"
 24note = """## Triage and analysis
 25
 26### Investigating ESXi Multiple Logon Failures by User and Source
 27
 28Each failed Host Client or API logon is a hostd line pam_do_authenticate: error with rhost=<address> and
 29login:<account>. The query uses GROK to take those two values from message, then counts failures for the
 30same account and remote address. The rule lookback is 9 minutes, and the alert requires at least 3 failures
 31within 10 minutes apart.
 32
 33#### Possible investigation steps
 34
 35- Read user.name, source.ip, and Esql.failure_count.
 36- Compare source.ip with known jump hosts and administrator workstations.
 37- Look for a following Accepted password for user for the same account from that address.
 38- On the host, check whether the account is locked: esxcli system account list.
 39
 40### False positive analysis
 41
 42A short run of mistyped passwords from one workstation is commonly benign. Failures from an unknown address, or failures followed by a successful login, deserve review.
 43
 44### Response and remediation
 45
 46- If the source is not approved, block it and rotate the targeted account password.
 47- Unlock the account if the lockout threshold was reached and the activity was not approved.
 48- Preserve hostd.log for the source address and account.
 49"""
 50references = [
 51    "https://lolesxi-project.github.io/LOLESXi/#",
 52    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
 53    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
 54]
 55setup = """## Setup
 56
 57This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
 58"""
 59risk_score = 47
 60rule_id = "0e8c4128-43b9-53ee-804d-a98657a30964"
 61severity = "medium"
 62tags = [
 63    "Domain: Endpoint",
 64    "Data Source: VMware vSphere",
 65    "Use Case: Threat Detection",
 66    "Tactic: Credential Access",
 67    "Resources: Investigation Guide",
 68    "Rule Type: ES|QL",
 69    "Platform: VMware ESXi",
 70]
 71timestamp_override = "event.ingested"
 72type = "esql"
 73
 74query = '''
 75FROM logs-vsphere.log-*
 76| WHERE data_stream.dataset == "vsphere.log" AND event.module == "vsphere"
 77    AND message LIKE "*pam_do_authenticate: error*"
 78| GROK message "%{DATA}rhost=%{IP:source_ip}%{DATA}login:%{DATA:user}]%{GREEDYDATA}"
 79| WHERE user IS NOT NULL AND source_ip IS NOT NULL
 80| EVAL user.name = user, source.ip = source_ip
 81| STATS
 82    Esql.failure_count = COUNT(*),
 83    Esql.first_seen = MIN(@timestamp),
 84    Esql.last_seen = MAX(@timestamp),
 85    Esql.message_values = VALUES(message)
 86  BY user.name, source.ip, host.ip
 87| WHERE Esql.failure_count >= 3
 88| EVAL message = MV_FIRST(Esql.message_values)
 89| KEEP message, user.name, source.ip, host.ip, Esql.failure_count, Esql.first_seen, Esql.last_seen, Esql.message_values
 90'''
 91
 92[[rule.threat]]
 93framework = "MITRE ATT&CK"
 94[[rule.threat.technique]]
 95id = "T1110"
 96name = "Brute Force"
 97reference = "https://attack.mitre.org/techniques/T1110/"
 98[[rule.threat.technique.subtechnique]]
 99id = "T1110.001"
100name = "Password Guessing"
101reference = "https://attack.mitre.org/techniques/T1110/001/"
102
103[rule.threat.tactic]
104id = "TA0006"
105name = "Credential Access"
106reference = "https://attack.mitre.org/tactics/TA0006/"
107
108[rule.investigation_fields]
109field_names = [
110    "user.name",
111    "source.ip",
112    "message",
113    "host.ip",
114    "Esql.failure_count",
115    "Esql.first_seen",
116    "Esql.last_seen"
117]