VMware ESXi - Dormant VM started

Back


Id	4cdcd5d8-89df-4076-a917-bc50abb9f2ab
Rulename	VMware ESXi - Dormant VM started
Description	Detects when dormant VM was started.
Severity	Medium
Tactics	InitialAccess
Techniques	T1190
Required data connectors	SyslogAma VMwareESXi
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiDormantVMStarted.yaml
Version	1.0.2
Arm template	4cdcd5d8-89df-4076-a917-bc50abb9f2ab.json

KQL

let vm_p_off =
VMwareESXi
| where TimeGenerated > ago(14d)
| where SyslogMessage has ('VmPoweredOffEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| summarize LastPowerOffTime=max(TimeGenerated) by DstHostname
| where datetime_diff('day',datetime(now),LastPowerOffTime) >= 20; 
let vm_p_on =
VMwareESXi
| where TimeGenerated > ago(14d)
| where SyslogMessage has ('VmPoweredOnEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| summarize LastPowerOnTime=max(TimeGenerated) by DstHostname
| where datetime_diff('day',datetime(now),LastPowerOnTime) >= 20;
let off_vms =
vm_p_on
| join (vm_p_off) on DstHostname
| where LastPowerOffTime > LastPowerOnTime
| summarize p_off_vm = make_set(DstHostname,200)
| extend k=1;
VMwareESXi
| where TimeGenerated between (ago(24h) .. datetime(now))
| where SyslogMessage has ('VmPoweredOnEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| extend k=1
| join (off_vms) on k
| where p_off_vm !has DstHostname
| summarize rec_p_on = make_set(DstHostname,200)
| extend hostname = iff(array_length(rec_p_on) > 0, rec_p_on[0], "")
| extend NTDomain = tostring(split(hostname, '\\', 1)[0]), HostName = tostring(split(hostname, '.', 0)[0])

YAML

relevantTechniques:
- T1190
name: VMware ESXi - Dormant VM started
requiredDataConnectors:
- dataTypes:
  - VMwareESXi
  connectorId: VMwareESXi
- datatypes:
  - Syslog
  connectorId: SyslogAma
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: HostName
  - identifier: NTDomain
    columnName: NTDomain
  entityType: Host
triggerThreshold: 0
id: 4cdcd5d8-89df-4076-a917-bc50abb9f2ab
tactics:
- InitialAccess
version: 1.0.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiDormantVMStarted.yaml
queryPeriod: 14d
kind: Scheduled
queryFrequency: 1h
severity: Medium
description: |
    'Detects when dormant VM was started.'
query: |
  let vm_p_off =
  VMwareESXi
  | where TimeGenerated > ago(14d)
  | where SyslogMessage has ('VmPoweredOffEvent')
  | extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
  | summarize LastPowerOffTime=max(TimeGenerated) by DstHostname
  | where datetime_diff('day',datetime(now),LastPowerOffTime) >= 20; 
  let vm_p_on =
  VMwareESXi
  | where TimeGenerated > ago(14d)
  | where SyslogMessage has ('VmPoweredOnEvent')
  | extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
  | summarize LastPowerOnTime=max(TimeGenerated) by DstHostname
  | where datetime_diff('day',datetime(now),LastPowerOnTime) >= 20;
  let off_vms =
  vm_p_on
  | join (vm_p_off) on DstHostname
  | where LastPowerOffTime > LastPowerOnTime
  | summarize p_off_vm = make_set(DstHostname,200)
  | extend k=1;
  VMwareESXi
  | where TimeGenerated between (ago(24h) .. datetime(now))
  | where SyslogMessage has ('VmPoweredOnEvent')
  | extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
  | extend k=1
  | join (off_vms) on k
  | where p_off_vm !has DstHostname
  | summarize rec_p_on = make_set(DstHostname,200)
  | extend hostname = iff(array_length(rec_p_on) > 0, rec_p_on[0], "")
  | extend NTDomain = tostring(split(hostname, '\\', 1)[0]), HostName = tostring(split(hostname, '.', 0)[0])  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4cdcd5d8-89df-4076-a917-bc50abb9f2ab')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4cdcd5d8-89df-4076-a917-bc50abb9f2ab')]",
      "properties": {
        "alertRuleTemplateName": "4cdcd5d8-89df-4076-a917-bc50abb9f2ab",
        "customDetails": null,
        "description": "'Detects when dormant VM was started.'\n",
        "displayName": "VMware ESXi - Dormant VM started",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "HostName"
              },
              {
                "columnName": "NTDomain",
                "identifier": "NTDomain"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiDormantVMStarted.yaml",
        "query": "let vm_p_off =\nVMwareESXi\n| where TimeGenerated > ago(14d)\n| where SyslogMessage has ('VmPoweredOffEvent')\n| extend DstHostname = extract(@'\\[\\d+\\]\\s+\\[(.*?)\\s+on', 1, SyslogMessage)\n| summarize LastPowerOffTime=max(TimeGenerated) by DstHostname\n| where datetime_diff('day',datetime(now),LastPowerOffTime) >= 20; \nlet vm_p_on =\nVMwareESXi\n| where TimeGenerated > ago(14d)\n| where SyslogMessage has ('VmPoweredOnEvent')\n| extend DstHostname = extract(@'\\[\\d+\\]\\s+\\[(.*?)\\s+on', 1, SyslogMessage)\n| summarize LastPowerOnTime=max(TimeGenerated) by DstHostname\n| where datetime_diff('day',datetime(now),LastPowerOnTime) >= 20;\nlet off_vms =\nvm_p_on\n| join (vm_p_off) on DstHostname\n| where LastPowerOffTime > LastPowerOnTime\n| summarize p_off_vm = make_set(DstHostname,200)\n| extend k=1;\nVMwareESXi\n| where TimeGenerated between (ago(24h) .. datetime(now))\n| where SyslogMessage has ('VmPoweredOnEvent')\n| extend DstHostname = extract(@'\\[\\d+\\]\\s+\\[(.*?)\\s+on', 1, SyslogMessage)\n| extend k=1\n| join (off_vms) on k\n| where p_off_vm !has DstHostname\n| summarize rec_p_on = make_set(DstHostname,200)\n| extend hostname = iff(array_length(rec_p_on) > 0, rec_p_on[0], \"\")\n| extend NTDomain = tostring(split(hostname, '\\\\', 1)[0]), HostName = tostring(split(hostname, '.', 0)[0])\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1190"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}