LoFP / administrators create local accounts during onboarding or break-glass setup. confirm the account name and whether it was then granted the admin role.

Techniques

• T1136

Sample rules

ESXi Local Account Created

• source: elastic
• technicques:
  • T1136

Description

Detects creation of a local ESXi account. A new account is a separate login that remains after the session that created it. It has no rights until a role is assigned, and it is the first step toward a persistent login on the host.

Detection logic

data_stream.dataset:vsphere.log and event.module:vsphere and message:("esxcli system account add" or Account and "was created")