ESXi Host Logs Deleted with rm
editESXi Host Logs Deleted with rm
editDetects a shell rm of a path under /var/log or of a *.log name. Those files hold shell commands, authentication, and hostd activity. Removing them takes away the record of what changed on the host.
Rule type: query
Rule indices:
- logs-vsphere.log-*
Severity: high
Risk score: 73
Runs every: 5m
Searches indices from: now-9m (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 100
References:
Tags:
- Domain: Endpoint
- Data Source: VMware vSphere
- Use Case: Threat Detection
- Tactic: Defense Evasion
- Resources: Investigation Guide
- Rule Type: Custom Query (KQL)
- Platform: VMware ESXi
Version: 1
Rule authors:
- Elastic
Rule license: Elastic License v2
Investigation guide
editTriage and analysis
Investigating ESXi Host Logs Deleted with rm
shell.log records the typed command. The rule matches a line that contains rm together with a /var/log/ path or a *.log name, such as [root]: rm -f /var/log/hostd.log or [root]: rm *.log.
Possible investigation steps
- Read message and note the path that was deleted.
- On the host, list /var/log and see which files are missing, including shell.log, auth.log, and hostd.log.
- Review account changes, firewall changes, and VM power events from the same session that are still in the index.
False positive analysis
Deleting one rotated log during maintenance can be expected. rm *.log removes every log name in the current directory and should be explained by a ticket.
Response and remediation
- If the delete was not approved, isolate the host and preserve any remaining logs before they rotate.
- Rotate credentials used in that shell session.
- Confirm remote syslog still has a copy of the deleted host logs.
Setup
editSetup
This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
Rule query
editdata_stream.dataset:vsphere.log and event.module:vsphere and message:(rm and ("*.log" or "/var/log/*"))
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
-
Technique:
- Name: Indicator Removal
- ID: T1070
- Reference URL: https://attack.mitre.org/techniques/T1070/
-
Sub-technique:
- Name: Clear Linux or Mac System Logs
- ID: T1070.002
- Reference URL: https://attack.mitre.org/techniques/T1070/002/
-
Sub-technique:
- Name: File Deletion
- ID: T1070.004
- Reference URL: https://attack.mitre.org/techniques/T1070/004/