ESXi Local Account Created

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects creation of a local ESXi account. A new account is a separate login that remains after the session that
11created it. It has no rights until a role is assigned, and it is the first step toward a persistent login on the host.
12"""
13false_positives = [
14    """
15    Administrators create local accounts during onboarding or break-glass setup. Confirm the account name and whether
16it was then granted the Admin role.
17    """,
18]
19from = "now-9m"
20index = ["logs-vsphere.log-*"]
21language = "kuery"
22license = "Elastic License v2"
23name = "ESXi Local Account Created"
24note = """## Triage and analysis
25
26### Investigating ESXi Local Account Created
27
28Hostd records Account <name> was created on host <hostname> when an account is added from the Host Client or API. The shell records esxcli system account add. The new account has no role until a later permission change.
29
30#### Possible investigation steps
31
32- Read the account name in message and the user field on the hostd event, which is the account that created it.
33- Look for a following esxcli system permission set or an Admin role grant for the same account.
34- Compare the account with the approved list for that host.
35
36### False positive analysis
37
38A documented joiner or break-glass account is commonly benign. An unknown account created by root over the Host Client, then granted Admin, deserves review.
39
40### Response and remediation
41
42- If the account was not approved, remove it with esxcli system account remove --id <name>.
43- Preserve hostd.log and shell.log for the creating session.
44"""
45references = [
46    "https://lolesxi-project.github.io/LOLESXi/#",
47    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
48    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
49]
50setup = """## Setup
51
52This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
53"""
54risk_score = 47
55rule_id = "dff0caa0-9d14-5e75-946b-677c38734e9b"
56severity = "medium"
57tags = [
58    "Domain: Endpoint",
59    "Data Source: VMware vSphere",
60    "Use Case: Threat Detection",
61    "Tactic: Persistence",
62    "Resources: Investigation Guide",
63    "Rule Type: Custom Query (KQL)",
64    "Platform: VMware ESXi",
65    "Threat: Ransomware",
66]
67timestamp_override = "event.ingested"
68type = "query"
69
70query = '''
71data_stream.dataset:vsphere.log and event.module:vsphere and message:("esxcli system account add" or Account and "was created")
72'''
73
74[[rule.threat]]
75framework = "MITRE ATT&CK"
76[[rule.threat.technique]]
77id = "T1136"
78name = "Create Account"
79reference = "https://attack.mitre.org/techniques/T1136/"
80[[rule.threat.technique.subtechnique]]
81id = "T1136.001"
82name = "Local Account"
83reference = "https://attack.mitre.org/techniques/T1136/001/"
84
85[rule.threat.tactic]
86id = "TA0003"
87name = "Persistence"
88reference = "https://attack.mitre.org/tactics/TA0003/"
89
90[rule.investigation_fields]
91field_names = [
92    "@timestamp",
93    "message",
94    "event.original",
95    "host.hostname",
96    "log.file.path",
97]