ESXi Lockdown Mode Disabled

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects the disabling of ESXi lockdown mode, a critical security feature that restricts remote access to ESXi hosts.
11When lockdown mode is disabled, remote users can directly access and modify ESXi host configurations using the root
12login. When enabled, the ESXi host is accessible only through the local console or vCenter Server.
13"""
14false_positives = [
15    """
16    Administrators disable lockdown mode for a documented maintenance window, then turn it back on.
17    Confirm the change ticket and that lockdown mode is enabled again afterward.
18    """,
19]
20from = "now-9m"
21index = ["logs-vsphere.log-*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "ESXi Lockdown Mode Disabled"
25note = """## Triage and analysis
26
27### Investigating ESXi Lockdown Mode Disabled
28
29Lockdown mode limits remote administration of the host. Turning it off restores direct administrator access from SSH and the API.
30
31#### Possible investigation steps
32
33- Read message for esx.audit.lockdownmode.disabled or the shell command lockdown_mode_exit. A DCUI change records the audit id and does not record lockdown_mode_exit.
34- Note the account in the hostd user field. A DCUI change shows user=dcui.
35- On the host, run vim-cmd -U dcui vimsvc/auth/lockdown_is_enabled and confirm whether it is still off.
36- Check the same session for new accounts, an Admin role grant, or a root password change.
37
38### False positive analysis
39
40A short maintenance window that disables lockdown mode and enables it again can be expected. The host should not be left with lockdown mode off.
41
42### Response and remediation
43
44- If the change was not approved, enable lockdown mode again from the DCUI or with vim-cmd -U dcui vimsvc/auth/lockdown_mode_enter.
45- Review accounts and permissions changed in the same session.
46- Preserve hostd.log before rotating credentials.
47"""
48references = [
49    "https://lolesxi-project.github.io/LOLESXi/#",
50    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
51    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
52]
53setup = """## Setup
54
55This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
56"""
57risk_score = 73
58rule_id = "567050d5-fe4e-54f7-b81f-131af20f903d"
59severity = "high"
60tags = [
61    "Domain: Endpoint",
62    "Data Source: VMware vSphere",
63    "Use Case: Threat Detection",
64    "Tactic: Defense Evasion",
65    "Resources: Investigation Guide",
66    "Rule Type: Custom Query (KQL)",
67    "Platform: VMware ESXi",
68]
69timestamp_override = "event.ingested"
70type = "query"
71
72query = '''
73data_stream.dataset:vsphere.log and event.module:vsphere and message:(esx.audit.lockdownmode.disabled or lockdown_mode_exit)
74'''
75
76[[rule.threat]]
77framework = "MITRE ATT&CK"
78[[rule.threat.technique]]
79id = "T1562"
80name = "Impair Defenses"
81reference = "https://attack.mitre.org/techniques/T1562/"
82[[rule.threat.technique.subtechnique]]
83id = "T1562.001"
84name = "Disable or Modify Tools"
85reference = "https://attack.mitre.org/techniques/T1562/001/"
86
87[rule.threat.tactic]
88id = "TA0005"
89name = "Defense Evasion"
90reference = "https://attack.mitre.org/tactics/TA0005/"
91
92[rule.investigation_fields]
93field_names = [
94    "@timestamp",
95    "message",
96    "event.original",
97    "host.hostname",
98    "log.file.path",
99]