ESXi Audit Records Disabled

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Audit Records Disabled

Detects ESXi audit record transmission being turned off, locally or to a remote collector. Audit records are the host’s own trail of administrative changes. Disabling them means later changes to accounts, the firewall, and SSH are not recorded there.

Rule type: query

Rule indices:

logs-vsphere.log-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Endpoint
Data Source: VMware vSphere
Use Case: Threat Detection
Tactic: Defense Evasion
Resources: Investigation Guide
Rule Type: Custom Query (KQL)
Platform: VMware ESXi

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Audit Records Disabled

ESXi audit records capture administrative changes. Turning off local or remote transmission hides the commands that follow, including firewall, account, and VM actions.

Possible investigation steps

Read message to see whether local or remote transmission was disabled.
Check for a later auditrecords command that sets --enabled true.
Correlate with syslog reset, firewall changes, and VM shutdowns.

False positive analysis

A collector outage can include a temporary disable. The setting should be turned back on in the same change.

Response and remediation

Re-enable local and remote audit transmission.
Review shell and hostd logs for commands issued while auditing was off.
If the disable was unauthorized, isolate the host and rotate credentials.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit

data_stream.dataset:vsphere.log and message:(auditrecords and ("--enabled false" or "--enabled=false" or "local disable" or "remote disable"))

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Technique:
- Name: Impair Defenses
- ID: T1562
- Reference URL: https://attack.mitre.org/techniques/T1562/
Sub-technique:
- Name: Disable or Modify Tools
- ID: T1562.001
- Reference URL: https://attack.mitre.org/techniques/T1562/001/

« ESXi Multiple Logon Failures by User and Source ESXi File Made Executable with chmod »