LoFP / some recovery and lab images leave execinstalledonly off, and an approved change can disable it while a custom vib is installed. confirm the setting is restored to true afterward.

Techniques

• T1562

Sample rules

ESXi ExecInstalledOnly Protection Disabled

• source: elastic
• technicques:
  • T1562

Description

Detects ESXi ExecInstalledOnly protection being turned off. The setting limits execution to binaries that were installed by a VIB and have not been modified. When it is set to false, the host can run files from paths such as /tmp that were never part of the system image.

Detection logic

data_stream.dataset:vsphere.log and event.module:vsphere and message:(execInstalledOnly and ("-i 0" or "-v 0" or FALSE))