VMware ESXi - Unexpected disk image

Back


Id	395c5560-ddc2-45b2-aafe-2e3f64528d3d
Rulename	VMware ESXi - Unexpected disk image
Description	Detects unexpected disk image for VM.
Severity	Medium
Tactics	Impact
Techniques	T1496
Required data connectors	SyslogAma VMwareESXi
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiUnexpectedDiskImage.yaml
Version	1.0.1
Arm template	395c5560-ddc2-45b2-aafe-2e3f64528d3d.json

KQL

let img_ =
VMwareESXi
| where SyslogMessage has ('Matched discovered VM')
| extend DstHostname = extract(@'vim.VirtualMachine\S+,(.*?)\]', 1, SyslogMessage)
| extend kImageName = extract(@'ds:///vmfs/volumes/(.*)/(.*?),', 2, SyslogMessage)
| summarize img_lst = makeset(kImageName) by DstHostname;
VMwareESXi
| where SyslogMessage has ('Matched discovered VM')
| extend DstHostname = extract(@'vim.VirtualMachine\S+,(.*?)\]', 1, SyslogMessage)
| extend ImageName = extract(@'ds:///vmfs/volumes/(.*)/(.*?),', 2, SyslogMessage)
| join (img_) on DstHostname
| where img_lst !has ImageName
| extend HostCustomEntity = DstHostname

YAML

relevantTechniques:
- T1496
name: VMware ESXi - Unexpected disk image
requiredDataConnectors:
- dataTypes:
  - VMwareESXi
  connectorId: VMwareESXi
- datatypes:
  - Syslog
  connectorId: SyslogAma
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: HostCustomEntity
  entityType: Host
triggerThreshold: 0
id: 395c5560-ddc2-45b2-aafe-2e3f64528d3d
tactics:
- Impact
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiUnexpectedDiskImage.yaml
queryPeriod: 14d
kind: Scheduled
queryFrequency: 1h
severity: Medium
status: Available
description: |
    'Detects unexpected disk image for VM.'
query: |
  let img_ =
  VMwareESXi
  | where SyslogMessage has ('Matched discovered VM')
  | extend DstHostname = extract(@'vim.VirtualMachine\S+,(.*?)\]', 1, SyslogMessage)
  | extend kImageName = extract(@'ds:///vmfs/volumes/(.*)/(.*?),', 2, SyslogMessage)
  | summarize img_lst = makeset(kImageName) by DstHostname;
  VMwareESXi
  | where SyslogMessage has ('Matched discovered VM')
  | extend DstHostname = extract(@'vim.VirtualMachine\S+,(.*?)\]', 1, SyslogMessage)
  | extend ImageName = extract(@'ds:///vmfs/volumes/(.*)/(.*?),', 2, SyslogMessage)
  | join (img_) on DstHostname
  | where img_lst !has ImageName
  | extend HostCustomEntity = DstHostname  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/395c5560-ddc2-45b2-aafe-2e3f64528d3d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/395c5560-ddc2-45b2-aafe-2e3f64528d3d')]",
      "properties": {
        "alertRuleTemplateName": "395c5560-ddc2-45b2-aafe-2e3f64528d3d",
        "customDetails": null,
        "description": "'Detects unexpected disk image for VM.'\n",
        "displayName": "VMware ESXi - Unexpected disk image",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostCustomEntity",
                "identifier": "FullName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiUnexpectedDiskImage.yaml",
        "query": "let img_ =\nVMwareESXi\n| where SyslogMessage has ('Matched discovered VM')\n| extend DstHostname = extract(@'vim.VirtualMachine\\S+,(.*?)\\]', 1, SyslogMessage)\n| extend kImageName = extract(@'ds:///vmfs/volumes/(.*)/(.*?),', 2, SyslogMessage)\n| summarize img_lst = makeset(kImageName) by DstHostname;\nVMwareESXi\n| where SyslogMessage has ('Matched discovered VM')\n| extend DstHostname = extract(@'vim.VirtualMachine\\S+,(.*?)\\]', 1, SyslogMessage)\n| extend ImageName = extract(@'ds:///vmfs/volumes/(.*)/(.*?),', 2, SyslogMessage)\n| join (img_) on DstHostname\n| where img_lst !has ImageName\n| extend HostCustomEntity = DstHostname\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1496"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}