ESXi Root Password Accepted from Remote Host

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects hostd accepting the ESXi root password from a remote address. A successful remote root login opens the
11Host Client or the API with full control of the host. Local sessions from 127.0.0.1 are left out of the rule.
12"""
13false_positives = [
14    """
15    Administrators sign in to the Host Client or the API as root from a jump host during maintenance. Confirm the
16source address is a known workstation and that the session does not continue into SSH enablement, file copies to
17`/tmp`, or virtual machine shutdowns.
18    """,
19]
20from = "now-9m"
21index = ["logs-vsphere.log-*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "ESXi Root Password Accepted from Remote Host"
25note = """## Triage and analysis
26
27### Investigating ESXi Root Password Accepted from Remote Host
28
29Vimsvc.HaSessionManager writes this line when a root password is accepted. The source after from is the client address. A remote address is a direct HTTPS login to the host. from 127.0.0.1 is local esxcli and is not part of this rule. vpxuser from 127.0.0.1 is the host's own client.
30
31#### Possible investigation steps
32
33- Read the source address in message. Compare it with known admin workstations.
34- In the same sid and opID, look for the following User root@<ip> logged in event and for SSH access has been enabled.
35- Check later shell commands for chmod, /tmp, and /vmfs/volumes.
36
37### False positive analysis
38
39A documented Host Client login as root from the admin network can be benign. A root acceptance from an unexpected address, followed by SSH being enabled, is the lateral-movement pattern.
40
41### Response and remediation
42
43- If the source was not approved, disable the session, rotate the root password, and review accounts created in that window.
44- Preserve hostd.log for the sid on the event.
45- Hunt other hosts for Accepted password for user root from the same source address.
46"""
47references = [
48    "https://lolesxi-project.github.io/LOLESXi/#",
49    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
50    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
51]
52setup = """## Setup
53
54This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
55"""
56risk_score = 47
57rule_id = "b4837b9b-db8b-5b7c-afa5-599202651b10"
58severity = "medium"
59tags = [
60    "Domain: Endpoint",
61    "Data Source: VMware vSphere",
62    "Use Case: Threat Detection",
63    "Tactic: Initial Access",
64    "Resources: Investigation Guide",
65    "Rule Type: Custom Query (KQL)",
66    "Platform: VMware ESXi",
67    "Threat: Ransomware",
68]
69timestamp_override = "event.ingested"
70type = "query"
71
72query = '''
73data_stream.dataset:vsphere.log and event.module:vsphere and message:("Accepted password for user root" and not "from 127.0.0.1")
74'''
75
76[[rule.threat]]
77framework = "MITRE ATT&CK"
78[[rule.threat.technique]]
79id = "T1078"
80name = "Valid Accounts"
81reference = "https://attack.mitre.org/techniques/T1078/"
82[[rule.threat.technique.subtechnique]]
83id = "T1078.001"
84name = "Default Accounts"
85reference = "https://attack.mitre.org/techniques/T1078/001/"
86
87[rule.threat.tactic]
88id = "TA0001"
89name = "Initial Access"
90reference = "https://attack.mitre.org/tactics/TA0001/"
91
92[rule.investigation_fields]
93field_names = [
94    "@timestamp",
95    "message",
96    "event.original",
97    "host.hostname",
98    "log.file.path",
99]