LoFP / audit settings change during collector maintenance. confirm that transmission was enabled again and that the change matches a ticket.

Techniques

• T1562

Sample rules

ESXi Audit Records Disabled

• source: elastic
• technicques:
  • T1562

Description

Detects ESXi audit record transmission being turned off, locally or to a remote collector. Audit records are the host’s own trail of administrative changes. Disabling them means later changes to accounts, the firewall, and SSH are not recorded there.

Detection logic

data_stream.dataset:vsphere.log and message:(auditrecords and ("--enabled false" or "--enabled=false" or "local disable" or "remote disable"))