administrators rotate the root password during scheduled maintenance. confirm the change ticket and that the new password was stored with the approved break-glass process.

t1098
vsphere
elastic

Techniques

T1098

Sample rules

ESXi Root Password Changed

source: elastic
technicques:
- T1098

Description

Detects a change to the ESXi root password, the credential for SSH, the Host Client, and the API. Replacing it locks out the previous password and gives the new value full control of the host. Hostd records Password was changed for account root. The shell records esxcli system account set -i root.

Detection logic

data_stream.dataset:vsphere.log and event.module:vsphere and message:("Password was changed for account root" or "-i root" and "esxcli system account set")