LoFP LoFP / administrators enable ssh for a documented troubleshooting window. esxi often disables the service again on reboot, so a later enable by a known operator can be expected.

Techniques

Sample rules

ESXi SSH Access Enabled

Description

Detects ESXi SSH being turned on. SSH is often left disabled so the host is managed through the local console, the Host Client, or vCenter. Enabling it opens a remote shell that can copy files onto the host and run commands against the datastore.

Detection logic

data_stream.dataset:vsphere.log and message:("SSH access has been enabled" or "hostsvc/enable_ssh")