ESXi Account Creation Via ESXCLI

calendar Nov 20, 2024 · attack.persistence attack.t1136  ·
Share on: linkedin copy

Detects user account creation on ESXi system via esxcli

Sigma rule (View on GitHub)

 1title: ESXi Account Creation Via ESXCLI
 2id: b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db
 3status: test
 4description: Detects user account creation on ESXi system via esxcli
 5references:
 6    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
 7author: Cedric Maurugeon
 8date: 2023-08-22
 9tags:
10    - attack.persistence
11    - attack.t1136
12logsource:
13    category: process_creation
14    product: linux
15detection:
16    selection:
17        Image|endswith: '/esxcli'
18        CommandLine|contains|all:
19            - 'system '
20            - 'account '
21            - 'add '
22    condition: selection
23falsepositives:
24    - Legitimate administration activities
25level: medium

References

  • ESXCLI Commands | ESXCLI Command Reference

    Command Description Options Help system account add Create a new local user account. --description | -d User description, e.g. full name. --id | -i User ID, e.g. "administrator". (required) --passw...


    Read More

Related rules

to-top