ESXi File Made Executable with chmod

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects chmod making a file executable on an ESXi host, including `+x` and numeric modes such as `755` and `777`.
11The host will not run a file until the execute bit is set. Making a file under `/tmp` executable is the step that
12lets a later command launch it against the datastore.
13"""
14false_positives = [
15    """
16    Administrators mark a maintenance or support script executable during a change window. Confirm the path, the
17account, and whether the same session then executes a file from `/tmp` or enumerates virtual disks.
18    """,
19]
20from = "now-9m"
21index = ["logs-vsphere.log-*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "ESXi File Made Executable with chmod"
25note = """## Triage and analysis
26
27### Investigating ESXi File Made Executable with chmod
28
29chmod +x, chmod a+x, and numeric modes such as 777 and 755 add the execute bit. On ESXi this is the step that turns a file dropped in /tmp into a runnable payload. Modes that do not grant execute, such as 644, are not included.
30
31#### Possible investigation steps
32
33- Read the full command in message, including the target path.
34- Check the same session for a copy into /tmp, a following execution of that path, VM process kills, or a search for vmdk files.
35- Confirm with the virtualization owner whether that file was part of an approved script.
36
37### False positive analysis
38
39Support workflows sometimes chmod a known script. A chmod of an unknown file under /tmp, followed by execution, is the staging pattern.
40
41### Response and remediation
42
43- If the file was not approved, remove it and end the shell session.
44- Preserve shell.log and review commands issued after the chmod.
45- If the path was executed, isolate the host and rotate credentials used in that session.
46"""
47references = [
48    "https://lolesxi-project.github.io/LOLESXi/#",
49    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
50    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
51]
52setup = """## Setup
53
54This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
55"""
56risk_score = 47
57rule_id = "c4e0a1d2-7b58-5f31-9c44-6a8e2f0d91ab"
58severity = "medium"
59tags = [
60    "Domain: Endpoint",
61    "Data Source: VMware vSphere",
62    "Use Case: Threat Detection",
63    "Tactic: Defense Evasion",
64    "Resources: Investigation Guide",
65    "Rule Type: Custom Query (KQL)",
66    "Platform: VMware ESXi",
67    "Threat: Ransomware",
68]
69timestamp_override = "event.ingested"
70type = "query"
71
72query = '''
73data_stream.dataset:vsphere.log and event.module:vsphere and message:(chmod and ("+x" or 0511 or 0555 or 0700 or 0711 or 0750 or 0755 or 0775 or 0777 or 111 or 1777 or 4755 or 511 or 555 or 700 or 711 or 750 or 755 or 775 or 777 or "a+x" or "g+x" or "o+x" or "u+x"))
74'''
75
76[[rule.threat]]
77framework = "MITRE ATT&CK"
78[[rule.threat.technique]]
79id = "T1222"
80name = "File and Directory Permissions Modification"
81reference = "https://attack.mitre.org/techniques/T1222/"
82[[rule.threat.technique.subtechnique]]
83id = "T1222.002"
84name = "Linux and Mac File and Directory Permissions Modification"
85reference = "https://attack.mitre.org/techniques/T1222/002/"
86
87[rule.threat.tactic]
88id = "TA0005"
89name = "Defense Evasion"
90reference = "https://attack.mitre.org/tactics/TA0005/"
91
92[rule.investigation_fields]
93field_names = [
94    "@timestamp",
95    "message",
96    "event.original",
97    "host.hostname",
98    "log.file.path",
99]