ID | Technique | Tactic |
---|---|---|
T1562 | Impair Defenses | Defense Evasion |
Detection: ESXi VIB Acceptance Level Tampering
Description
This detection identifies changes to the VIB (vSphere Installation Bundle) acceptance level on an ESXi host. Modifying the acceptance level, such as setting it to CommunitySupported, lowers the system's integrity enforcement and may allow the installation of unsigned or unverified software.
Search
1`esxi_syslog` Message="*esxcli software acceptance set*" Message="*shell*"
2| rex field=_raw "\]: \[(?<user>\w+)\]:(?<command>.+)"
3| rex field=_raw "Z (?<dest>[\w\.]+)\s"
4| stats min(_time) as firstTime max(_time) as lastTime count by dest user command
5| `security_content_ctime(firstTime)`
6| `security_content_ctime(lastTime)`
7| `esxi_vib_acceptance_level_tampering_filter`
Data Source
Name | Platform | Sourcetype | Source |
---|---|---|---|
VMWare ESXi Syslog | N/A | 'vmw-syslog' |
'vmware:esxlog' |
Macros Used
Name | Value |
---|---|
esxi_syslog | sourcetype=vmw-syslog OR sourcetype=vmware:esxlog* |
esxi_vib_acceptance_level_tampering_filter | search * |
esxi_vib_acceptance_level_tampering_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
Known False Positives
Administrators may use this command when installing third party VIBs. Tune as needed.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message:
VIB Acceptance level was modified on ESXi host $dest$ by $user$.
Risk Object | Risk Object Type | Risk Score | Threat Objects |
---|---|---|---|
user | user | 60 | No Threat Objects |
dest | system | 60 | No Threat Objects |
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | vmware:esxlog |
vmw-syslog |
Integration | ✅ Passing | Dataset | vmware:esxlog |
vmw-syslog |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 1