VMware ESXi - Multiple new VMs started

Back


Id	bdea247f-7d17-498c-ac0e-c7e764cbdbbe
Rulename	VMware ESXi - Multiple new VMs started
Description	Detects when multiple new VMs were started.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiMultipleNewVM.yaml
Version	1.0.3
Arm template	bdea247f-7d17-498c-ac0e-c7e764cbdbbe.json

KQL

let threshold = 5;
let a_vm = 
VMwareESXi
| where SyslogMessage has ('VmPoweredOnEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| summarize vm_l = make_set(DstHostname,200)
| extend k=1;
VMwareESXi
| where SyslogMessage has ('VmPoweredOnEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| extend SrcUsername = extract(@'\[info\]\s+\[(.*?)\]', 1, SyslogMessage)
| extend k = 1
| join (a_vm) on k
| where vm_l !has DstHostname
| summarize n_vm = make_set(DstHostname,200) by SrcUsername, bin(TimeGenerated, 10m)
| where array_length(n_vm) >= threshold
| extend hostname = iff(array_length(n_vm) > 0, n_vm[0], "")
| extend NTDomain = tostring(split(hostname, '\\', 1)[0]), HostName = tostring(split(hostname, '.', 0)[0])

YAML

description: |
    'Detects when multiple new VMs were started.'
entityMappings:
- fieldMappings:
  - columnName: HostName
    identifier: HostName
  - columnName: NTDomain
    identifier: NTDomain
  entityType: Host
query: |
  let threshold = 5;
  let a_vm = 
  VMwareESXi
  | where SyslogMessage has ('VmPoweredOnEvent')
  | extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
  | summarize vm_l = make_set(DstHostname,200)
  | extend k=1;
  VMwareESXi
  | where SyslogMessage has ('VmPoweredOnEvent')
  | extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
  | extend SrcUsername = extract(@'\[info\]\s+\[(.*?)\]', 1, SyslogMessage)
  | extend k = 1
  | join (a_vm) on k
  | where vm_l !has DstHostname
  | summarize n_vm = make_set(DstHostname,200) by SrcUsername, bin(TimeGenerated, 10m)
  | where array_length(n_vm) >= threshold
  | extend hostname = iff(array_length(n_vm) > 0, n_vm[0], "")
  | extend NTDomain = tostring(split(hostname, '\\', 1)[0]), HostName = tostring(split(hostname, '.', 0)[0])  
tactics:
- InitialAccess
severity: Medium
triggerThreshold: 0
queryFrequency: 1h
status: Available
queryPeriod: 1h
relevantTechniques:
- T1078
id: bdea247f-7d17-498c-ac0e-c7e764cbdbbe
name: VMware ESXi - Multiple new VMs started
kind: Scheduled
triggerOperator: gt
version: 1.0.3
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiMultipleNewVM.yaml
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma

ARM