VMware ESXi - Multiple new VMs started

Back


Id	bdea247f-7d17-498c-ac0e-c7e764cbdbbe
Rulename	VMware ESXi - Multiple new VMs started
Description	Detects when multiple new VMs were started.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Required data connectors	SyslogAma VMwareESXi
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiMultipleNewVM.yaml
Version	1.0.2
Arm template	bdea247f-7d17-498c-ac0e-c7e764cbdbbe.json

KQL

let threshold = 5;
let a_vm = 
VMwareESXi
| where SyslogMessage has ('VmPoweredOnEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| summarize vm_l = make_set(DstHostname,200)
| extend k=1;
VMwareESXi
| where SyslogMessage has ('VmPoweredOnEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| extend SrcUsername = extract(@'\[info\]\s+\[(.*?)\]', 1, SyslogMessage)
| extend k = 1
| join (a_vm) on k
| where vm_l !has DstHostname
| summarize n_vm = make_set(DstHostname,200) by SrcUsername, bin(TimeGenerated, 10m)
| where array_length(n_vm) >= threshold
| extend hostname = iff(array_length(n_vm) > 0, n_vm[0], "")
| extend NTDomain = tostring(split(hostname, '\\', 1)[0]), HostName = tostring(split(hostname, '.', 0)[0])

YAML

relevantTechniques:
- T1078
name: VMware ESXi - Multiple new VMs started
requiredDataConnectors:
- dataTypes:
  - VMwareESXi
  connectorId: VMwareESXi
- datatypes:
  - Syslog
  connectorId: SyslogAma
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: HostName
  - identifier: NTDomain
    columnName: NTDomain
  entityType: Host
triggerThreshold: 0
id: bdea247f-7d17-498c-ac0e-c7e764cbdbbe
tactics:
- InitialAccess
version: 1.0.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiMultipleNewVM.yaml
queryPeriod: 1h
kind: Scheduled
queryFrequency: 1h
severity: Medium
status: Available
description: |
    'Detects when multiple new VMs were started.'
query: |
  let threshold = 5;
  let a_vm = 
  VMwareESXi
  | where SyslogMessage has ('VmPoweredOnEvent')
  | extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
  | summarize vm_l = make_set(DstHostname,200)
  | extend k=1;
  VMwareESXi
  | where SyslogMessage has ('VmPoweredOnEvent')
  | extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
  | extend SrcUsername = extract(@'\[info\]\s+\[(.*?)\]', 1, SyslogMessage)
  | extend k = 1
  | join (a_vm) on k
  | where vm_l !has DstHostname
  | summarize n_vm = make_set(DstHostname,200) by SrcUsername, bin(TimeGenerated, 10m)
  | where array_length(n_vm) >= threshold
  | extend hostname = iff(array_length(n_vm) > 0, n_vm[0], "")
  | extend NTDomain = tostring(split(hostname, '\\', 1)[0]), HostName = tostring(split(hostname, '.', 0)[0])  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/bdea247f-7d17-498c-ac0e-c7e764cbdbbe')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/bdea247f-7d17-498c-ac0e-c7e764cbdbbe')]",
      "properties": {
        "alertRuleTemplateName": "bdea247f-7d17-498c-ac0e-c7e764cbdbbe",
        "customDetails": null,
        "description": "'Detects when multiple new VMs were started.'\n",
        "displayName": "VMware ESXi - Multiple new VMs started",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "HostName"
              },
              {
                "columnName": "NTDomain",
                "identifier": "NTDomain"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiMultipleNewVM.yaml",
        "query": "let threshold = 5;\nlet a_vm = \nVMwareESXi\n| where SyslogMessage has ('VmPoweredOnEvent')\n| extend DstHostname = extract(@'\\[\\d+\\]\\s+\\[(.*?)\\s+on', 1, SyslogMessage)\n| summarize vm_l = make_set(DstHostname,200)\n| extend k=1;\nVMwareESXi\n| where SyslogMessage has ('VmPoweredOnEvent')\n| extend DstHostname = extract(@'\\[\\d+\\]\\s+\\[(.*?)\\s+on', 1, SyslogMessage)\n| extend SrcUsername = extract(@'\\[info\\]\\s+\\[(.*?)\\]', 1, SyslogMessage)\n| extend k = 1\n| join (a_vm) on k\n| where vm_l !has DstHostname\n| summarize n_vm = make_set(DstHostname,200) by SrcUsername, bin(TimeGenerated, 10m)\n| where array_length(n_vm) >= threshold\n| extend hostname = iff(array_length(n_vm) > 0, n_vm[0], \"\")\n| extend NTDomain = tostring(split(hostname, '\\\\', 1)[0]), HostName = tostring(split(hostname, '.', 0)[0])\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}