detection.wiki

Detection rules › Kusto

VMware vCenter - Root login

Status
available
Severity
high
Time window
14d
Source
github.com/Azure/Azure-Sentinel

'Detects when root user login from uncommon IP address.'

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Privilege Escalation

Rule body

id: 03e8a895-b5ba-49a0-aed3-f9a997d92fbe
name: VMware vCenter - Root login
description: |
  'Detects when root user login from uncommon IP address.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CustomLogsAma
    dataTypes:
      - vcenter_CL
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - PrivilegeEscalation
relevantTechniques:
  - T1078
query: |
  let p_lookback = 14d;
  let t_lookback = 1h;
  let root_ips = vCenter
  | where TimeGenerated between (ago(p_lookback) .. ago(t_lookback))
  | where EventType has_all ('UserLoginSessionEvent', 'root', 'logged in')
  | summarize make_set(SourceIP,128);
  vCenter
  | where TimeGenerated > ago(t_lookback)
  | where EventType   has_all ('UserLoginSessionEvent', 'root', 'logged in')
  | where SourceIP   !in (root_ips)
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP
version: 1.0.2
kind: Scheduled

Stages and Predicates

Parameters

let p_lookback = 14d;
let t_lookback = 1h;

Let binding: root_ips used in Stage 4

let root_ips = vCenter
| where TimeGenerated between (ago(p_lookback) .. ago(t_lookback))
| where EventType has_all ('UserLoginSessionEvent', 'root', 'logged in')
| summarize make_set(SourceIP,128);

Stage 1: source

vCenter

Stage 2: where

| where TimeGenerated > ago(t_lookback)

Stage 3: where

| where EventType   has_all ('UserLoginSessionEvent', 'root', 'logged in')

Stage 4: where

| where SourceIP   !in (root_ips)

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
SourceIPeqroot_ipsexcludes:SourceIP field:"SourceIP" value:"root_ips"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventTypematch
  • UserLoginSessionEvent transforms: term
  • logged in transforms: term
  • root transforms: term
field:"EventType" kind:match