ESXi Syslog Remote Host Reset

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects the ESXi remote syslog destination being cleared with `--reset=loghost`. The loghost is where host logs
11are forwarded for retention and detection. Clearing it keeps later commands on the host only, so an external
12collector stops receiving them.
13"""
14false_positives = [
15    """
16    An administrator can reset the loghost while moving the host to a new collector. Confirm
17that a new `--loghost` value was set in the same change and that logs are arriving at the collector.
18    """,
19]
20from = "now-9m"
21index = ["logs-vsphere.log-*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "ESXi Syslog Remote Host Reset"
25note = """## Triage and analysis
26
27### Investigating ESXi Syslog Remote Host Reset
28
29Remote syslog is often the only copy of ESXi shell history that leaves the host. --reset=loghost drops that destination. Obfuscated commands in the same reports decode to this exact esxcli line.
30
31#### Possible investigation steps
32
33- Read message for a literal esxcli line or an obfuscated line that still contains reset=loghost.
34- Run or review esxcli system syslog config get and confirm whether Remote Host is empty.
35- Correlate with firewall, SSH, and VM shutdown commands from the same session.
36
37### False positive analysis
38
39Collector migrations reset the old loghost and then set a new one. An empty loghost that stays empty is not a migration.
40
41### Response and remediation
42
43- Restore the collector: esxcli system syslog config set --loghost=<collector> and reload syslog.
44- Pull local shell.log, hostd.log, and auth.log before they rotate. The gap while loghost was empty will be missing from the collector.
45- If the reset was unauthorized, isolate the host.
46"""
47references = [
48    "https://lolesxi-project.github.io/LOLESXi/#",
49    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
50    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
51]
52setup = """## Setup
53
54This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
55"""
56risk_score = 73
57rule_id = "9bd3bba8-e4c3-5670-9553-4d91e19ec328"
58severity = "high"
59tags = [
60    "Domain: Endpoint",
61    "Data Source: VMware vSphere",
62    "Use Case: Threat Detection",
63    "Tactic: Defense Evasion",
64    "Resources: Investigation Guide",
65    "Rule Type: Custom Query (KQL)",
66    "Platform: VMware ESXi",
67]
68timestamp_override = "event.ingested"
69type = "query"
70
71query = '''
72data_stream.dataset:vsphere.log and message:("syslog config set" and ("--reset loghost" or "--reset=loghost" or "reset=loghost"))
73'''
74
75[[rule.threat]]
76framework = "MITRE ATT&CK"
77[[rule.threat.technique]]
78id = "T1562"
79name = "Impair Defenses"
80reference = "https://attack.mitre.org/techniques/T1562/"
81[[rule.threat.technique.subtechnique]]
82id = "T1562.001"
83name = "Disable or Modify Tools"
84reference = "https://attack.mitre.org/techniques/T1562/001/"
85
86[rule.threat.tactic]
87id = "TA0005"
88name = "Defense Evasion"
89reference = "https://attack.mitre.org/tactics/TA0005/"
90
91[rule.investigation_fields]
92field_names = [
93    "@timestamp",
94    "message",
95    "event.original",
96    "host.hostname",
97    "log.file.path",
98]