Detection rules › Kusto
VMware ESXi - SSH Enable on ESXi Host
'Detects when vim-cmd is used to enable SSH on an ESXi host'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement |
Rule body
id: 4f5b5d79-ff4e-4edd-ae3e-9e1187f0b924
name: VMware ESXi - SSH Enable on ESXi Host
description: |
'Detects when vim-cmd is used to enable SSH on an ESXi host'
severity: High
status: Available
requiredDataConnectors:
- connectorId: SyslogAma
datatypes:
- Syslog
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
- LateralMovement
relevantTechniques:
- T1021
query: |
VMwareESXi
| where SyslogMessage has_all ("vim-cmd","hostsvc/enable_ssh")
| extend SrcUsername = extract(@'\[info\]\s+\[(.*?)\]', 1, SyslogMessage)
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
entityMappings:
- entityType: Host
fieldMappings:
- identifier: FullName
columnName: DstHostname
- entityType: Account
fieldMappings:
- identifier: Name
columnName: SrcUsername
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
VMwareESXi
Stage 2: where
| where SyslogMessage has_all ("vim-cmd","hostsvc/enable_ssh")
Stage 3: extend
| extend SrcUsername = extract(@'\[info\]\s+\[(.*?)\]', 1, SyslogMessage)
Stage 4: extend
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
SyslogMessage | match |
| field:"SyslogMessage" kind:match |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
SrcUsername | extend |
DstHostname | extend |