ESXi Root Password Accepted from Remote Host

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Root Password Accepted from Remote Host

Detects hostd accepting the ESXi root password from a remote address. A successful remote root login opens the Host Client or the API with full control of the host. Local sessions from 127.0.0.1 are left out of the rule.

Rule type: query

Rule indices:

logs-vsphere.log-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Endpoint
Data Source: VMware vSphere
Use Case: Threat Detection
Tactic: Initial Access
Resources: Investigation Guide
Rule Type: Custom Query (KQL)
Platform: VMware ESXi
Threat: Ransomware

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Root Password Accepted from Remote Host

Vimsvc.HaSessionManager writes this line when a root password is accepted. The source after from is the client address. A remote address is a direct HTTPS login to the host. from 127.0.0.1 is local esxcli and is not part of this rule. vpxuser from 127.0.0.1 is the host’s own client.

Possible investigation steps

Read the source address in message. Compare it with known admin workstations.
In the same sid and opID, look for the following User root@<ip> logged in event and for SSH access has been enabled.
Check later shell commands for chmod, /tmp, and /vmfs/volumes.

False positive analysis

A documented Host Client login as root from the admin network can be benign. A root acceptance from an unexpected address, followed by SSH being enabled, is the lateral-movement pattern.

Response and remediation

If the source was not approved, disable the session, rotate the root password, and review accounts created in that window.
Preserve hostd.log for the sid on the event.
Hunt other hosts for Accepted password for user root from the same source address.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit

data_stream.dataset:vsphere.log and event.module:vsphere and message:("Accepted password for user root" and not "from 127.0.0.1")

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Initial Access
- ID: TA0001
- Reference URL: https://attack.mitre.org/tactics/TA0001/
Technique:
- Name: Valid Accounts
- ID: T1078
- Reference URL: https://attack.mitre.org/techniques/T1078/
Sub-technique:
- Name: Default Accounts
- ID: T1078.001
- Reference URL: https://attack.mitre.org/techniques/T1078/001/

« ESXi Virtual Machine Process Killed ESXi SSH Access Enabled »