ID | Technique | Tactic |
---|---|---|
T1098 | Account Manipulation | Persistence |
T1078 | Valid Accounts | Privilege Escalation |
Detection: ESXi User Granted Admin Role
Description
This detection identifies when a user is granted the Administrator role on an ESXi host. Assigning elevated privileges is a critical action that can indicate potential malicious behavior if performed unexpectedly. Adversaries who gain access may use this to escalate privileges, maintain persistence, or disable security controls.
Search
1`esxi_syslog` Message="*esxcli system permission set*" AND Message="*role Admin*"
2| rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)"
3| rex field=_raw "--id (?<target_user>\w+)"
4| rex field=_raw "Z (?<dest>[\w\.]+)\s"
5| stats min(_time) as firstTime max(_time) as lastTime count by dest user command target_user
6| `security_content_ctime(firstTime)`
7| `security_content_ctime(lastTime)`
8| `esxi_user_granted_admin_role_filter`
Data Source
Name | Platform | Sourcetype | Source |
---|---|---|---|
VMWare ESXi Syslog | N/A | 'vmw-syslog' |
'vmware:esxlog' |
Macros Used
Name | Value |
---|---|
esxi_syslog | sourcetype=vmw-syslog OR sourcetype=vmware:esxlog* |
esxi_user_granted_admin_role_filter | search * |
esxi_user_granted_admin_role_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
Known False Positives
Limited false positives in most environments after initial setup, however tune as needed.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message:
$target_user$ granted Admin role on ESXi host $dest$ by $user$.
Risk Object | Risk Object Type | Risk Score | Threat Objects |
---|---|---|---|
target_user | user | 60 | No Threat Objects |
dest | system | 60 | No Threat Objects |
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | vmware:esxlog |
vmw-syslog |
Integration | ✅ Passing | Dataset | vmware:esxlog |
vmw-syslog |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 1