ESXi System and Account Enumeration

  1[metadata]
  2creation_date = "2026/09/30"
  3integration = ["vsphere"]
  4maturity = "production"
  5updated_date = "2026/09/30"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects shell commands that collect ESXi host details or the local account list, including `uname -a`, system
 11version, hostname, and `esxcli system account list`. The output identifies the build and the accounts that can
 12log in. Listing accounts shows which identities exist before one of them is changed or used.
 13"""
 14false_positives = [
 15    """
 16    Administrators run these commands during inventory, troubleshooting, and support. Review whether the same session
 17continues into virtual machine shutdown, snapshot removal, or a datastore search.
 18    """,
 19]
 20from = "now-9m"
 21index = ["logs-vsphere.log-*"]
 22language = "kuery"
 23license = "Elastic License v2"
 24name = "ESXi System and Account Enumeration"
 25note = """## Triage and analysis
 26
 27### Investigating ESXi System and Account Enumeration
 28
 29These commands collect the OS build, product version, hostname, or the local account list. Account listing is the higher-interest command. Version and hostname checks are common on their own.
 30
 31#### Possible investigation steps
 32
 33- Read message to see which command ran.
 34- Check the same session for vm process list, vm process kill, chmod, or a search under /vmfs/volumes.
 35- For esxcli system account list, compare the listed accounts with the known set for that host.
 36
 37### False positive analysis
 38
 39A single version or hostname check during maintenance is commonly benign. Several of these commands in one session, especially account listing followed by VM shutdown, deserves review.
 40
 41### Response and remediation
 42
 43- If the same session kills virtual machines or writes a file under /tmp, isolate the host.
 44- Otherwise record the account and source for hunting on other hosts.
 45"""
 46references = [
 47    "https://lolesxi-project.github.io/LOLESXi/#",
 48    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
 49    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
 50]
 51setup = """## Setup
 52
 53This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
 54"""
 55risk_score = 21
 56rule_id = "5173b00b-9546-5925-862a-a93e43472b29"
 57severity = "low"
 58tags = [
 59    "Domain: Endpoint",
 60    "Data Source: VMware vSphere",
 61    "Use Case: Threat Detection",
 62    "Tactic: Discovery",
 63    "Resources: Investigation Guide",
 64    "Rule Type: Custom Query (KQL)",
 65    "Platform: VMware ESXi",
 66    "Threat: Ransomware",
 67]
 68timestamp_override = "event.ingested"
 69type = "query"
 70
 71query = '''
 72data_stream.dataset: "vsphere.log" and event.module: "vsphere" and 
 73message: (
 74  "uname -a" or
 75  "esxcli system version get" or
 76  "esxcli system hostname get" or
 77  "esxcli system account list"
 78)
 79'''
 80
 81[[rule.threat]]
 82framework = "MITRE ATT&CK"
 83[[rule.threat.technique]]
 84id = "T1082"
 85name = "System Information Discovery"
 86reference = "https://attack.mitre.org/techniques/T1082/"
 87
 88[[rule.threat.technique]]
 89id = "T1087"
 90name = "Account Discovery"
 91reference = "https://attack.mitre.org/techniques/T1087/"
 92[[rule.threat.technique.subtechnique]]
 93id = "T1087.001"
 94name = "Local Account"
 95reference = "https://attack.mitre.org/techniques/T1087/001/"
 96
 97[rule.threat.tactic]
 98id = "TA0007"
 99name = "Discovery"
100reference = "https://attack.mitre.org/tactics/TA0007/"
101
102[rule.investigation_fields]
103field_names = [
104    "@timestamp",
105    "message",
106    "event.original",
107    "host.hostname",
108    "log.file.path",
109]