ESXi Root Password Changed

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects a change to the ESXi root password, the credential for SSH, the Host Client, and the API.
11Replacing it locks out the previous password and gives the new value full control of the host.
12Hostd records `Password was changed for account root`. The shell records `esxcli system account set -i root`.
13"""
14false_positives = [
15    """
16    Administrators rotate the root password during scheduled maintenance. Confirm the change ticket and
17    that the new password was stored with the approved break-glass process.
18    """,
19]
20from = "now-9m"
21index = ["logs-vsphere.log-*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "ESXi Root Password Changed"
25note = """## Triage and analysis
26
27### Investigating ESXi Root Password Changed
28
29The root account is the local administrator on a standalone ESXi host. A password change keeps the same account and replaces the credential used for SSH, the Host Client, and the API.
30
31#### Possible investigation steps
32
33- Read message for Password was changed for account root or esxcli system account set -i root.
34- Note the account in the hostd user field. That is who performed the change.
35- Check the same session for lockdown mode being disabled, a new local account, or an Admin role grant.
36- Ask whether the new password was recorded in the approved secret store.
37
38### False positive analysis
39
40A documented root password rotation is commonly benign. An unplanned change, especially after lockdown mode was disabled, deserves review.
41
42### Response and remediation
43
44- If the change was not approved, set a new root password and store it with the break-glass process.
45- Review other account and permission changes from the same session.
46- Preserve hostd.log and shell.log before closing the session.
47"""
48references = [
49    "https://lolesxi-project.github.io/LOLESXi/#",
50    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
51    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
52]
53setup = """## Setup
54
55This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
56"""
57risk_score = 47
58rule_id = "44d5aacb-8e56-5819-8ba3-5e397691fdc8"
59severity = "medium"
60tags = [
61    "Domain: Endpoint",
62    "Data Source: VMware vSphere",
63    "Use Case: Threat Detection",
64    "Tactic: Persistence",
65    "Resources: Investigation Guide",
66    "Rule Type: Custom Query (KQL)",
67    "Platform: VMware ESXi",
68]
69timestamp_override = "event.ingested"
70type = "query"
71
72query = '''
73data_stream.dataset:vsphere.log and event.module:vsphere and message:("Password was changed for account root" or "-i root" and "esxcli system account set")
74'''
75
76[[rule.threat]]
77framework = "MITRE ATT&CK"
78[[rule.threat.technique]]
79id = "T1098"
80name = "Account Manipulation"
81reference = "https://attack.mitre.org/techniques/T1098/"
82
83[rule.threat.tactic]
84id = "TA0003"
85name = "Persistence"
86reference = "https://attack.mitre.org/tactics/TA0003/"
87
88[rule.investigation_fields]
89field_names = [
90    "@timestamp",
91    "message",
92    "event.original",
93    "host.hostname",
94    "log.file.path",
95]