LoFP / rare troubleshooting can open an ssh session with vpxuser. confirm the source address and that the session matches a change ticket. vcenter itself manages hosts through the api, not through ssh as vpxuser.

Techniques

• T1021

Sample rules

ESXi SSH Session from vpxuser

• source: elastic
• technicques:
  • T1021

Description

Identifies a successful SSH session opened by the privileged vpxuser account. vpxuser is a service account used by VMware vCenter Server to manage ESXi hosts. An SSH session from that account reaches the host shell directly, outside the vCenter management path, and is a sign the credential is being reused with malicious intent.

Detection logic

data_stream.dataset:vsphere.log and event.module:vsphere and message:("SSH session was opened for" and vpxuser)