Detection rules › Kusto

VMware ESXi - SSH Enable on ESXi Host

Status
available
Severity
high
Time window
10m
Source
github.com/Azure/Azure-Sentinel

'Detects when vim-cmd is used to enable SSH on an ESXi host'

MITRE ATT&CK coverage

TacticTechniques
Lateral Movement

Rule body

id: 4f5b5d79-ff4e-4edd-ae3e-9e1187f0b924
name: VMware ESXi - SSH Enable on ESXi Host
description: |
  'Detects when vim-cmd is used to enable SSH on an ESXi host'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
relevantTechniques:
  - T1021
query: |
  VMwareESXi
  | where SyslogMessage has_all ("vim-cmd","hostsvc/enable_ssh")
  | extend SrcUsername = extract(@'\[info\]\s+\[(.*?)\]', 1, SyslogMessage)
  | extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DstHostname
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: SrcUsername
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

VMwareESXi

Stage 2: where

| where SyslogMessage has_all ("vim-cmd","hostsvc/enable_ssh")

Stage 3: extend

| extend SrcUsername = extract(@'\[info\]\s+\[(.*?)\]', 1, SyslogMessage)

Stage 4: extend

| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
SyslogMessagematch
  • hostsvc/enable_ssh transforms: term
  • vim-cmd transforms: term
field:"SyslogMessage" kind:match

Output fields

These fields are emitted when the rule matches.

FieldSource
SrcUsernameextend
DstHostnameextend