ESXi Audit Records Disabled

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects ESXi audit record transmission being turned off, locally or to a remote collector. Audit records are the
11host's own trail of administrative changes. Disabling them means later changes to accounts, the firewall, and SSH
12are not recorded there.
13"""
14false_positives = [
15    """
16    Audit settings change during collector maintenance. Confirm that transmission was
17enabled again and that the change matches a ticket.
18    """,
19]
20from = "now-9m"
21index = ["logs-vsphere.log-*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "ESXi Audit Records Disabled"
25note = """## Triage and analysis
26
27### Investigating ESXi Audit Records Disabled
28
29ESXi audit records capture administrative changes. Turning off local or remote transmission hides the commands that follow, including firewall, account, and VM actions.
30
31#### Possible investigation steps
32
33- Read message to see whether local or remote transmission was disabled.
34- Check for a later auditrecords command that sets --enabled true.
35- Correlate with syslog reset, firewall changes, and VM shutdowns.
36
37### False positive analysis
38
39A collector outage can include a temporary disable. The setting should be turned back on in the same change.
40
41### Response and remediation
42
43- Re-enable local and remote audit transmission.
44- Review shell and hostd logs for commands issued while auditing was off.
45- If the disable was unauthorized, isolate the host and rotate credentials.
46"""
47references = [
48    "https://lolesxi-project.github.io/LOLESXi/#",
49    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
50    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
51]
52setup = """## Setup
53
54This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
55"""
56risk_score = 47
57rule_id = "224d0328-36d4-553f-804a-5ff765aa85e5"
58severity = "medium"
59tags = [
60    "Domain: Endpoint",
61    "Data Source: VMware vSphere",
62    "Use Case: Threat Detection",
63    "Tactic: Defense Evasion",
64    "Resources: Investigation Guide",
65    "Rule Type: Custom Query (KQL)",
66    "Platform: VMware ESXi",
67]
68timestamp_override = "event.ingested"
69type = "query"
70
71query = '''
72data_stream.dataset:vsphere.log and message:(auditrecords and ("--enabled false" or "--enabled=false" or "local disable" or "remote disable"))
73'''
74
75[[rule.threat]]
76framework = "MITRE ATT&CK"
77[[rule.threat.technique]]
78id = "T1562"
79name = "Impair Defenses"
80reference = "https://attack.mitre.org/techniques/T1562/"
81[[rule.threat.technique.subtechnique]]
82id = "T1562.001"
83name = "Disable or Modify Tools"
84reference = "https://attack.mitre.org/techniques/T1562/001/"
85
86[rule.threat.tactic]
87id = "TA0005"
88name = "Defense Evasion"
89reference = "https://attack.mitre.org/tactics/TA0005/"
90
91[rule.investigation_fields]
92field_names = [
93    "@timestamp",
94    "message",
95    "event.original",
96    "host.hostname",
97    "log.file.path",
98    "host.ip"
99]