Techniques
Sample rules
ESXi Host Prepared for an Unsigned Install
- source: elastic
- technicques:
- T1021
- T1553
- T1562
Description
Detects three changes on the same ESXi host within 1 hour: SSH enabled, ExecInstalledOnly turned off, and a
VIB install with -f or --force and --no-sig-check. Together they open a remote shell, allow unsigned code to
run, and bypass VIB signature checks. That sequence prepares the host to receive and run a package the normal
controls would reject.
Detection logic
FROM logs-vsphere.log-*
| WHERE data_stream.dataset == "vsphere.log" AND event.module == "vsphere" and host.ip is not null
| EVAL Esql.message_lower = TO_LOWER(message)
| EVAL
Esql.ssh_enabled = CASE(
Esql.message_lower LIKE "*ssh access has been enabled*" OR Esql.message_lower LIKE "*hostsvc/enable_ssh*",
1, 0
),
Esql.exec_installed_only_disabled = CASE(
Esql.message_lower LIKE "*execinstalledonly*" AND (
Esql.message_lower LIKE "*false*" OR Esql.message_lower LIKE "* -i 0*" OR Esql.message_lower LIKE "* -v 0*"
),
1, 0
),
Esql.vib_force_install = CASE(
Esql.message_lower LIKE "*vib install*" AND (
Esql.message_lower LIKE "* -f *" OR Esql.message_lower LIKE "* -f"
OR Esql.message_lower LIKE "* --force *" OR Esql.message_lower LIKE "* --force"
),
1, 0
)
| WHERE Esql.ssh_enabled == 1 OR Esql.exec_installed_only_disabled == 1 OR Esql.vib_force_install == 1
| STATS
Esql.ssh_enabled_count = SUM(Esql.ssh_enabled),
Esql.exec_installed_only_disabled_count = SUM(Esql.exec_installed_only_disabled),
Esql.vib_force_install_count = SUM(Esql.vib_force_install),
Esql.message_values = VALUES(message),
Esql.log_file_path_values = VALUES(vsphere.log.file.path),
Esql.first_seen = MIN(@timestamp),
Esql.last_seen = MAX(@timestamp)
BY host.ip
| WHERE Esql.ssh_enabled_count > 0
AND Esql.exec_installed_only_disabled_count > 0
AND Esql.vib_force_install_count > 0
| KEEP host.ip, Esql.ssh_enabled_count, Esql.exec_installed_only_disabled_count, Esql.vib_force_install_count,
Esql.message_values, Esql.log_file_path_values, Esql.first_seen, Esql.last_seen