ESXi SSH Session from vpxuser

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies a successful SSH session opened by the privileged vpxuser account. vpxuser is a service account used by
11VMware vCenter Server to manage ESXi hosts. An SSH session from that account reaches the host shell directly,
12outside the vCenter management path, and is a sign the credential is being reused with malicious intent.
13"""
14false_positives = [
15    """
16    Rare troubleshooting can open an SSH session with vpxuser. Confirm the source address and that the session
17    matches a change ticket. vCenter itself manages hosts through the API, not through SSH as vpxuser.
18    """,
19]
20from = "now-9m"
21index = ["logs-vsphere.log-*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "ESXi SSH Session from vpxuser"
25note = """## Triage and analysis
26
27### Investigating ESXi SSH Session from vpxuser
28
29Hostd records SSH session was opened for 'vpxuser@<address>' when that account gets a shell. vpxuser is created for vCenter and is not an interactive operator account.
30
31#### Possible investigation steps
32
33- Read the address after vpxuser@ in message and compare it with the vCenter server.
34- Review shell commands in the same session, especially copies to /tmp, vm process, and datastore paths.
35- Check whether SSH was enabled on this host just before the session.
36- Ask whether anyone used vpxuser for a documented console session.
37
38### False positive analysis
39
40An approved break-glass SSH session with vpxuser should be rare and tied to a ticket. A session from an address that is not the vCenter server deserves review.
41
42### Response and remediation
43
44- If the session was not approved, disable SSH and terminate the session.
45- Rotate the vpxuser credential from vCenter and review other hosts for the same account.
46- Preserve hostd.log and shell.log for the session.
47"""
48references = [
49    "https://lolesxi-project.github.io/LOLESXi/#",
50    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
51    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
52]
53setup = """## Setup
54
55This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
56"""
57risk_score = 73
58rule_id = "eb4de742-3183-55a9-942f-c3d3d93d806b"
59severity = "high"
60tags = [
61    "Domain: Endpoint",
62    "Data Source: VMware vSphere",
63    "Use Case: Threat Detection",
64    "Tactic: Lateral Movement",
65    "Resources: Investigation Guide",
66    "Rule Type: Custom Query (KQL)",
67    "Platform: VMware ESXi",
68]
69timestamp_override = "event.ingested"
70type = "query"
71
72query = '''
73data_stream.dataset:vsphere.log and event.module:vsphere and message:("SSH session was opened for" and vpxuser)
74'''
75
76[[rule.threat]]
77framework = "MITRE ATT&CK"
78[[rule.threat.technique]]
79id = "T1021"
80name = "Remote Services"
81reference = "https://attack.mitre.org/techniques/T1021/"
82[[rule.threat.technique.subtechnique]]
83id = "T1021.004"
84name = "SSH"
85reference = "https://attack.mitre.org/techniques/T1021/004/"
86
87[rule.threat.tactic]
88id = "TA0008"
89name = "Lateral Movement"
90reference = "https://attack.mitre.org/tactics/TA0008/"
91
92[rule.investigation_fields]
93field_names = [
94    "@timestamp",
95    "message",
96    "event.original",
97    "host.hostname",
98    "log.file.path",
99]