ESXi Attempt to Force Install a VMware VIB Package

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects an attempt to install a VMware VIB with `--force`. A VIB is how ESXi adds drivers and host software,
11and signature checks normally block an unsigned package. `--force` skips that validation, so an untrusted
12package can be written onto the hypervisor and affect every virtual machine it runs.
13"""
14false_positives = [
15    """
16    Administrators sometimes force a vendor VIB during a documented recovery or upgrade when the acceptance
17    level would otherwise reject it. Confirm the VIB name against the change ticket.
18    """,
19]
20from = "now-9m"
21index = ["logs-vsphere.log-*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "ESXi Attempt to Force Install a VMware VIB Package"
25note = """## Triage and analysis
26
27### Investigating ESXi Attempt to Force Install a VMware VIB Package
28
29esxcli software vib install --force writes the package even when its signature or acceptance level would block it. The shell records the command in shell.log, including attempts that fail because the file is missing.
30
31#### Possible investigation steps
32
33- Read the VIB path in message (-v, -d, or --viburl). A path under /tmp is worth a closer look.
34- On the host, run esxcli software vib list and compare new packages with the approved image.
35- Check the same session for ExecInstalledOnly set to FALSE and SSH being enabled.
36
37### False positive analysis
38
39A forced install of a known vendor VIB during an approved window can be expected. The package name should match the ticket.
40
41### Response and remediation
42
43- If the package was not approved, remove it with esxcli software vib remove and review files left under /tmp.
44- Set ExecInstalledOnly back to TRUE if it was turned off in the same session.
45- Preserve shell.log before rotating credentials.
46"""
47references = [
48    "https://lolesxi-project.github.io/LOLESXi/#",
49    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
50    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
51]
52setup = """## Setup
53
54This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
55"""
56risk_score = 47
57rule_id = "3c9a356d-d878-555c-9d27-a7028c9a074f"
58severity = "medium"
59tags = [
60    "Domain: Endpoint",
61    "Data Source: VMware vSphere",
62    "Use Case: Threat Detection",
63    "Tactic: Defense Evasion",
64    "Resources: Investigation Guide",
65    "Rule Type: Custom Query (KQL)",
66    "Platform: VMware ESXi",
67]
68timestamp_override = "event.ingested"
69type = "query"
70
71query = '''
72data_stream.dataset:vsphere.log and event.module:vsphere and message:("vib install" and ("--force" or "-f" or "--no-sig-check"))
73'''
74
75[[rule.threat]]
76framework = "MITRE ATT&CK"
77[[rule.threat.technique]]
78id = "T1553"
79name = "Subvert Trust Controls"
80reference = "https://attack.mitre.org/techniques/T1553/"
81[[rule.threat.technique.subtechnique]]
82id = "T1553.006"
83name = "Code Signing Policy Modification"
84reference = "https://attack.mitre.org/techniques/T1553/006/"
85
86[rule.threat.tactic]
87id = "TA0005"
88name = "Defense Evasion"
89reference = "https://attack.mitre.org/tactics/TA0005/"
90
91[rule.investigation_fields]
92field_names = [
93    "@timestamp",
94    "message",
95    "event.original",
96    "host.hostname",
97    "log.file.path",
98    "process.pid"
99]