MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: 4cdcd5d8-89df-4076-a917-bc50abb9f2ab
name: VMware ESXi - Dormant VM started
description: |
'Detects when dormant VM was started.'
severity: Medium
requiredDataConnectors:
- connectorId: SyslogAma
datatypes:
- Syslog
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1190
query: |
let vm_p_off =
VMwareESXi
| where TimeGenerated > ago(14d)
| where SyslogMessage has ('VmPoweredOffEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| summarize LastPowerOffTime=max(TimeGenerated) by DstHostname
| where datetime_diff('day',datetime(now),LastPowerOffTime) >= 20;
let vm_p_on =
VMwareESXi
| where TimeGenerated > ago(14d)
| where SyslogMessage has ('VmPoweredOnEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| summarize LastPowerOnTime=max(TimeGenerated) by DstHostname
| where datetime_diff('day',datetime(now),LastPowerOnTime) >= 20;
let off_vms =
vm_p_on
| join (vm_p_off) on DstHostname
| where LastPowerOffTime > LastPowerOnTime
| summarize p_off_vm = make_set(DstHostname,200)
| extend k=1;
VMwareESXi
| where TimeGenerated between (ago(24h) .. datetime(now))
| where SyslogMessage has ('VmPoweredOnEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| extend k=1
| join (off_vms) on k
| where p_off_vm !has DstHostname
| summarize rec_p_on = make_set(DstHostname,200)
| extend hostname = iff(array_length(rec_p_on) > 0, rec_p_on[0], "")
| extend NTDomain = tostring(split(hostname, '\\', 1)[0]), HostName = tostring(split(hostname, '.', 0)[0])
entityMappings:
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: HostName
- identifier: NTDomain
columnName: NTDomain
version: 1.0.3
kind: Scheduled
Stages and Predicates
Let binding: vm_p_off
let vm_p_off = VMwareESXi
| where TimeGenerated > ago(14d)
| where SyslogMessage has ('VmPoweredOffEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| summarize LastPowerOffTime=max(TimeGenerated) by DstHostname
| where datetime_diff('day',datetime(now),LastPowerOffTime) >= 20;
Let binding: vm_p_on
let vm_p_on = VMwareESXi
| where TimeGenerated > ago(14d)
| where SyslogMessage has ('VmPoweredOnEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| summarize LastPowerOnTime=max(TimeGenerated) by DstHostname
| where datetime_diff('day',datetime(now),LastPowerOnTime) >= 20;
Let binding: off_vms
let off_vms = vm_p_on
| join (vm_p_off) on DstHostname
| where LastPowerOffTime > LastPowerOnTime
| summarize p_off_vm = make_set(DstHostname,200)
| extend k=1;
Stage 1: source
VMwareESXi
Stage 2: where
| where TimeGenerated between (ago(24h) .. datetime(now))
Stage 3: where
| where SyslogMessage has ('VmPoweredOnEvent')
Stage 4: extend
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
Stage 5: extend
| extend k=1
Stage 6: join
| join (off_vms) on k
Stage 7: where
| where p_off_vm !has DstHostname
Stage 8: summarize
| summarize rec_p_on = make_set(DstHostname,200)
Stage 9: extend
| extend hostname = iff(array_length(rec_p_on) > 0, rec_p_on[0], "")
hostname =if
rec_p_on > 0rec_p_on[0]else
""Stage 10: extend
| extend NTDomain = tostring(split(hostname, '\\', 1)[0]), HostName = tostring(split(hostname, '.', 0)[0])
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
LastPowerOffTime | cross_field_compare |
| field:"LastPowerOffTime" kind:cross_field_compare value:"LastPowerOnTime" |
SyslogMessage | match |
| field:"SyslogMessage" kind:match |
p_off_vm | cross_field_compare |
| field:"p_off_vm" kind:cross_field_compare value:"DstHostname" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
rec_p_on | summarize |
hostname | extend |
HostName | extend |
NTDomain | extend |