ESXi ExecInstalledOnly Protection Disabled

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects ESXi ExecInstalledOnly protection being turned off. The setting limits execution to binaries that were
11installed by a VIB and have not been modified. When it is set to false, the host can run files from paths such
12as `/tmp` that were never part of the system image.
13"""
14false_positives = [
15    """
16    Some recovery and lab images leave ExecInstalledOnly off, and an approved change can disable it while a
17    custom VIB is installed. Confirm the setting is restored to TRUE afterward.
18    """,
19]
20from = "now-9m"
21index = ["logs-vsphere.log-*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "ESXi ExecInstalledOnly Protection Disabled"
25note = """## Triage and analysis
26
27### Investigating ESXi ExecInstalledOnly Protection Disabled
28
29ExecInstalledOnly limits execution to binaries that were installed by a VIB and have not been modified. Turning it off lets a later payload run from a path such as /tmp.
30
31#### Possible investigation steps
32
33- Read message for execInstalledOnly set to FALSE, or /User/ExecInstalledOnly set with -i 0.
34- On the host, run esxcli system settings kernel list -o execInstalledOnly and compare Configured with Runtime.
35- Look for a following vib install with --force, a chmod that adds execute permission, or a file launched from /tmp.
36
37### False positive analysis
38
39A documented install of an unsigned vendor VIB can disable the setting for the duration of the change. The setting should be TRUE when the work is finished.
40
41### Response and remediation
42
43- If the change was not approved, set the control back on: esxcli system settings kernel set -s execInstalledOnly -v TRUE.
44- Review VIBs installed in the same session with esxcli software vib list.
45- Preserve shell.log before rotating credentials.
46"""
47references = [
48    "https://lolesxi-project.github.io/LOLESXi/#",
49    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
50    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
51]
52setup = """## Setup
53
54This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
55"""
56risk_score = 73
57rule_id = "c7eb51a1-6ca4-5fd2-9842-0f81a046bdd2"
58severity = "high"
59tags = [
60    "Domain: Endpoint",
61    "Data Source: VMware vSphere",
62    "Use Case: Threat Detection",
63    "Tactic: Defense Evasion",
64    "Resources: Investigation Guide",
65    "Rule Type: Custom Query (KQL)",
66    "Platform: VMware ESXi",
67]
68timestamp_override = "event.ingested"
69type = "query"
70
71query = '''
72data_stream.dataset:vsphere.log and event.module:vsphere and message:(execInstalledOnly and ("-i 0" or "-v 0" or FALSE))
73'''
74
75[[rule.threat]]
76framework = "MITRE ATT&CK"
77[[rule.threat.technique]]
78id = "T1562"
79name = "Impair Defenses"
80reference = "https://attack.mitre.org/techniques/T1562/"
81[[rule.threat.technique.subtechnique]]
82id = "T1562.001"
83name = "Disable or Modify Tools"
84reference = "https://attack.mitre.org/techniques/T1562/001/"
85
86[rule.threat.tactic]
87id = "TA0005"
88name = "Defense Evasion"
89reference = "https://attack.mitre.org/tactics/TA0005/"
90
91[rule.investigation_fields]
92field_names = [
93    "@timestamp",
94    "message",
95    "event.original",
96    "host.hostname",
97    "log.file.path",
98]