GitHub Repo

Detection: ESXi Account Modified

Updated Date: 2025-07-01 ID: b5e3b024-a7bb-4019-8975-46cf54485e78 Author: Raven Tait, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

This detection identifies the creation, deletion, or modification of a local user account on an ESXi host. This activity may indicate unauthorized access, indicator removal, or persistence attempts by an attacker seeking to establish or maintain control of the host.

1`esxi_syslog` Message="*esxcli system account*" Message IN ("*-i *","*--id*") NOT Message="*[shell*" 
2| rex field=_raw "Z (?<dest>[\w\.]+)\s.*: \[(?<initial_user>\w+)]:\s.+-i[d]*\s(?<modified_user>[\w_\-0-9]+)" 
3| stats min(_time) as firstTime max(_time) as lastTime count by dest initial_user modified_user 
4| `security_content_ctime(firstTime)` 
5| `security_content_ctime(lastTime)` 
6| `esxi_account_modified_filter`

Data Source

Name Platform Sourcetype Source
VMWare ESXi Syslog N/A 'vmw-syslog' 'vmware:esxlog'

Macros Used

Name Value
esxi_syslog sourcetype=vmw-syslog OR sourcetype=vmware:esxlog*
esxi_account_modified_filter search *
esxi_account_modified_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1136.001 Local Account Persistence
T1078 Valid Accounts Defense Evasion
T1098 Account Manipulation Initial Access
Delivery
Exploitation
Installation
DE.AE
CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Risk Event True
This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.

Known False Positives

New local accounts being created in ESXi is rare in most environments. Tune as needed.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

Local account created, deleted, or modified on ESXi $dest$.

Risk Object Risk Object Type Risk Score Threat Objects
dest system 60 No Threat Objects

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset vmware:esxlog vmw-syslog
Integration ✅ Passing Dataset vmware:esxlog vmw-syslog

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1