detection.wiki

Detection rules › Kusto

VMware ESXi - Root password changed

Status
available
Severity
high
Time window
10m
Source
github.com/Azure/Azure-Sentinel

'Detects when root user password is changed.'

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Persistence
Stealth

Rule body

id: 17b0ea43-5aeb-4dc4-ac3a-be84acb8d5b7
name: VMware ESXi - Root password changed
description: |
  'Detects when root user password is changed.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Persistence
  - DefenseEvasion
relevantTechniques:
  - T1078
  - T1098
  - T1556
query: |
  VMwareESXi
  | where SyslogMessage has_any ("password changed for root","Password was changed for account root")
  | extend SrcIpAddr = extract(@'root@(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SrcIpAddr
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

VMwareESXi

Stage 2: where

| where SyslogMessage has_any ("password changed for root","Password was changed for account root")

Stage 3: extend

| extend SrcIpAddr = extract(@'root@(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
SyslogMessagematch
  • Password was changed for account root transforms: term
  • password changed for root transforms: term
field:"SyslogMessage" kind:match

Output fields

These fields are emitted when the rule matches.

FieldSource
SrcIpAddrextend