VMware ESXi - Shared or stolen root account

Back


Id	9c496d6c-42a3-4896-9b6c-00254386928f
Rulename	VMware ESXi - Shared or stolen root account
Description	Detects when shared or stolen root account.
Severity	High
Tactics	InitialAccess PrivilegeEscalation
Techniques	T1078
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	1
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiSharedOrStolenRootAccount.yaml
Version	1.0.3
Arm template	9c496d6c-42a3-4896-9b6c-00254386928f.json

KQL

VMwareESXi
| where SyslogMessage has_all ('UserLoginSessionEvent', 'root', 'logged in')
| extend SrcIpAddr = extract(@'root@(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
| summarize count() by SrcIpAddr, bin(TimeGenerated, 15m)
| where count_ > 1
| extend IPCustomEntity = SrcIpAddr

YAML

triggerThreshold: 1
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiSharedOrStolenRootAccount.yaml
name: VMware ESXi - Shared or stolen root account
relevantTechniques:
- T1078
status: Available
version: 1.0.3
queryPeriod: 1h
kind: Scheduled
id: 9c496d6c-42a3-4896-9b6c-00254386928f
query: |
  VMwareESXi
  | where SyslogMessage has_all ('UserLoginSessionEvent', 'root', 'logged in')
  | extend SrcIpAddr = extract(@'root@(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
  | summarize count() by SrcIpAddr, bin(TimeGenerated, 15m)
  | where count_ > 1
  | extend IPCustomEntity = SrcIpAddr  
description: |
    'Detects when shared or stolen root account.'
queryFrequency: 1h
severity: High
triggerOperator: gt
tactics:
- InitialAccess
- PrivilegeEscalation

ARM