ESXi Account Creation Via ESXCLI

calendar May 21, 2025 · attack.persistence attack.execution attack.t1136 attack.t1059.012  ·
Share on: linkedin copy

Detects user account creation on ESXi system via esxcli

Sigma rule (View on GitHub)

 1title: ESXi Account Creation Via ESXCLI
 2id: b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db
 3status: test
 4description: Detects user account creation on ESXi system via esxcli
 5references:
 6    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
 7author: Cedric Maurugeon
 8date: 2023-08-22
 9tags:
10    - attack.persistence
11    - attack.execution
12    - attack.t1136
13    - attack.t1059.012
14logsource:
15    category: process_creation
16    product: linux
17detection:
18    selection:
19        Image|endswith: '/esxcli'
20        CommandLine|contains|all:
21            - 'system '
22            - 'account '
23            - 'add '
24    condition: selection
25falsepositives:
26    - Legitimate administration activities
27level: medium

References

  • ESXCLI Commands | ESXCLI Command Reference

    Command Description Options Help system account add Create a new local user account. --description | -d User description, e.g. full name. --id | -i User ID, e.g. "administrator". (required) --passw...


    Read More

Related rules

to-top