LoFP / new virtualization administrators and service accounts are granted admin during approved account provisioning. confirm the account name against the identity ticket.

Techniques

• T1098

Sample rules

ESXi Account Granted Admin Role

• source: elastic
• technicques:
  • T1098

Description

Detects an ESXi account being granted the Administrator role. Administrator is full control of the host, including the firewall, SSH, accounts, and every virtual machine. Granting it to another account keeps that access after the original session ends.

Detection logic

data_stream.dataset:vsphere.log and event.module:vsphere and message:("system permission set" and ("--role Admin" or "--role=Admin") or "Permission created" and "role is Administrator")