ESXi ExecInstalledOnly Protection Disabled

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi ExecInstalledOnly Protection Disabled

Detects ESXi ExecInstalledOnly protection being turned off. The setting limits execution to binaries that were installed by a VIB and have not been modified. When it is set to false, the host can run files from paths such as /tmp that were never part of the system image.

Rule type: query

Rule indices:

logs-vsphere.log-*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Endpoint
Data Source: VMware vSphere
Use Case: Threat Detection
Tactic: Defense Evasion
Resources: Investigation Guide
Rule Type: Custom Query (KQL)
Platform: VMware ESXi

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi ExecInstalledOnly Protection Disabled

ExecInstalledOnly limits execution to binaries that were installed by a VIB and have not been modified. Turning it off lets a later payload run from a path such as /tmp.

Possible investigation steps

Read message for execInstalledOnly set to FALSE, or /User/ExecInstalledOnly set with -i 0.
On the host, run esxcli system settings kernel list -o execInstalledOnly and compare Configured with Runtime.
Look for a following vib install with --force, a chmod that adds execute permission, or a file launched from /tmp.

False positive analysis

A documented install of an unsigned vendor VIB can disable the setting for the duration of the change. The setting should be TRUE when the work is finished.

Response and remediation

If the change was not approved, set the control back on: esxcli system settings kernel set -s execInstalledOnly -v TRUE.
Review VIBs installed in the same session with esxcli software vib list.
Preserve shell.log before rotating credentials.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit

data_stream.dataset:vsphere.log and event.module:vsphere and message:(execInstalledOnly and ("-i 0" or "-v 0" or FALSE))

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Technique:
- Name: Impair Defenses
- ID: T1562
- Reference URL: https://attack.mitre.org/techniques/T1562/
Sub-technique:
- Name: Disable or Modify Tools
- ID: T1562.001
- Reference URL: https://attack.mitre.org/techniques/T1562/001/

« ESXi File Made Executable with chmod ESXi Firewall Disabled »