ESXi SSH Access Enabled

  1[metadata]
  2creation_date = "2026/09/30"
  3integration = ["vsphere"]
  4maturity = "production"
  5updated_date = "2026/09/30"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects ESXi SSH being turned on. SSH is often left disabled so the host is managed through the local console,
 11the Host Client, or vCenter. Enabling it opens a remote shell that can copy files onto the host and run commands
 12against the datastore.
 13"""
 14false_positives = [
 15    """
 16    Administrators enable SSH for a documented troubleshooting window. ESXi often disables
 17the service again on reboot, so a later enable by a known operator can be expected.
 18    """,
 19]
 20from = "now-9m"
 21index = ["logs-vsphere.log-*"]
 22language = "kuery"
 23license = "Elastic License v2"
 24name = "ESXi SSH Access Enabled"
 25note = """## Triage and analysis
 26
 27### Investigating ESXi SSH Access Enabled
 28
 29SSH is disabled on many ESXi hosts. Turning it on is the step that lets an intruder who already has the root password open a shell and stage a payload in /tmp.
 30
 31#### Possible investigation steps
 32
 33- Confirm whether the hit is the hostd sentence SSH access has been enabled or the shell command hostsvc/enable_ssh.
 34- Review source.ip and the account on nearby authentication events.
 35- Check for a following cd /tmp, file upload, or vm process command.
 36- Ask whether a change ticket opened SSH on this host.
 37
 38### False positive analysis
 39
 40Documented troubleshooting enables SSH and should disable it afterward. An enable with no ticket, followed by datastore commands, is the intrusion pattern.
 41
 42### Response and remediation
 43
 44- If the enable was not approved, disable SSH (vim-cmd hostsvc/disable_ssh) after preserving logs.
 45- Rotate the root password and review accounts added in the same window.
 46- Hunt other hosts for the same hostd event.
 47"""
 48references = [
 49    "https://lolesxi-project.github.io/LOLESXi/#",
 50    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
 51    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
 52]
 53setup = """## Setup
 54
 55This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
 56"""
 57risk_score = 47
 58rule_id = "2ff3eded-6e58-5cad-8642-bb2b060affe0"
 59severity = "medium"
 60tags = [
 61    "Domain: Endpoint",
 62    "Data Source: VMware vSphere",
 63    "Use Case: Threat Detection",
 64    "Tactic: Lateral Movement",
 65    "Resources: Investigation Guide",
 66    "Rule Type: Custom Query (KQL)",
 67    "Platform: VMware ESXi",
 68]
 69timestamp_override = "event.ingested"
 70type = "query"
 71
 72query = '''
 73data_stream.dataset:vsphere.log and message:("SSH access has been enabled" or "hostsvc/enable_ssh")
 74'''
 75
 76[[rule.threat]]
 77framework = "MITRE ATT&CK"
 78[[rule.threat.technique]]
 79id = "T1021"
 80name = "Remote Services"
 81reference = "https://attack.mitre.org/techniques/T1021/"
 82[[rule.threat.technique.subtechnique]]
 83id = "T1021.004"
 84name = "SSH"
 85reference = "https://attack.mitre.org/techniques/T1021/004/"
 86
 87[rule.threat.tactic]
 88id = "TA0008"
 89name = "Lateral Movement"
 90reference = "https://attack.mitre.org/tactics/TA0008/"
 91
 92[rule.investigation_fields]
 93field_names = [
 94    "@timestamp",
 95    "message",
 96    "event.original",
 97    "host.hostname",
 98    "log.file.path",
 99    "host.ip",
100]