ESXi Account Creation Via ESXCLI

 1title: ESXi Account Creation Via ESXCLI
 2id: b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db
 3status: experimental
 4description: Detects user account creation on ESXi system via esxcli
 5references:
 6    - https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_system.html
 7author: Cedric Maurugeon
 8date: 2023/08/22
 9tags:
10    - attack.persistence
11    - attack.t1136
12logsource:
13    category: process_creation
14    product: linux
15detection:
16    selection:
17        Image|endswith: '/esxcli'
18        CommandLine|contains|all:
19            - 'system '
20            - 'account '
21            - 'add '
22    condition: selection
23falsepositives:
24    - Legitimate administration activities
25level: medium

References

• ESXCLI Reference - ESXi 7.0 ESXCLI Command Reference

  ESXCLI Reference The ESXCLI command set allows you to run common system administration commands against vSphere systems from an administration server of your choice. The actual list of commands dep...

  
  Read More

Related rules

• Suspicious 'Admin' Local User Creation with Net Command
• Activity From Anonymous IP Address
• Anomalous User Activity
• Atypical Travel
• New Country