« ESXi Account Granted Admin Role Suspicious Linux Process Connection to Bulletproof Hosting ASN »
Elastic Docs ›Elastic Security [8.19] ›Downloadable rule update v8.19.36

ESXi Root Password Changed

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Root Password Changed

edit

Detects a change to the ESXi root password, the credential for SSH, the Host Client, and the API. Replacing it locks out the previous password and gives the new value full control of the host. Hostd records Password was changed for account root. The shell records esxcli system account set -i root.

Rule type: query

Rule indices:

  • logs-vsphere.log-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Persistence
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Root Password Changed

The root account is the local administrator on a standalone ESXi host. A password change keeps the same account and replaces the credential used for SSH, the Host Client, and the API.

Possible investigation steps

  • Read message for Password was changed for account root or esxcli system account set -i root.
  • Note the account in the hostd user field. That is who performed the change.
  • Check the same session for lockdown mode being disabled, a new local account, or an Admin role grant.
  • Ask whether the new password was recorded in the approved secret store.

False positive analysis

A documented root password rotation is commonly benign. An unplanned change, especially after lockdown mode was disabled, deserves review.

Response and remediation

  • If the change was not approved, set a new root password and store it with the break-glass process.
  • Review other account and permission changes from the same session.
  • Preserve hostd.log and shell.log before closing the session.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit
data_stream.dataset:vsphere.log and event.module:vsphere and message:("Password was changed for account root" or "-i root" and "esxcli system account set")

Framework: MITRE ATT&CKTM

« ESXi Account Granted Admin Role Suspicious Linux Process Connection to Bulletproof Hosting ASN »