VMware ESXi - Multiple new VMs started

Back


Id	bdea247f-7d17-498c-ac0e-c7e764cbdbbe
Rulename	VMware ESXi - Multiple new VMs started
Description	Detects when multiple new VMs were started.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiMultipleNewVM.yaml
Version	1.0.3
Arm template	bdea247f-7d17-498c-ac0e-c7e764cbdbbe.json

KQL

let threshold = 5;
let a_vm = 
VMwareESXi
| where SyslogMessage has ('VmPoweredOnEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| summarize vm_l = make_set(DstHostname,200)
| extend k=1;
VMwareESXi
| where SyslogMessage has ('VmPoweredOnEvent')
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| extend SrcUsername = extract(@'\[info\]\s+\[(.*?)\]', 1, SyslogMessage)
| extend k = 1
| join (a_vm) on k
| where vm_l !has DstHostname
| summarize n_vm = make_set(DstHostname,200) by SrcUsername, bin(TimeGenerated, 10m)
| where array_length(n_vm) >= threshold
| extend hostname = iff(array_length(n_vm) > 0, n_vm[0], "")
| extend NTDomain = tostring(split(hostname, '\\', 1)[0]), HostName = tostring(split(hostname, '.', 0)[0])

YAML

requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiMultipleNewVM.yaml
triggerThreshold: 0
status: Available
relevantTechniques:
- T1078
queryPeriod: 1h
name: VMware ESXi - Multiple new VMs started
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: HostName
    identifier: HostName
  - columnName: NTDomain
    identifier: NTDomain
queryFrequency: 1h
triggerOperator: gt
kind: Scheduled
description: |
    'Detects when multiple new VMs were started.'
tactics:
- InitialAccess
severity: Medium
version: 1.0.3
query: |
  let threshold = 5;
  let a_vm = 
  VMwareESXi
  | where SyslogMessage has ('VmPoweredOnEvent')
  | extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
  | summarize vm_l = make_set(DstHostname,200)
  | extend k=1;
  VMwareESXi
  | where SyslogMessage has ('VmPoweredOnEvent')
  | extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
  | extend SrcUsername = extract(@'\[info\]\s+\[(.*?)\]', 1, SyslogMessage)
  | extend k = 1
  | join (a_vm) on k
  | where vm_l !has DstHostname
  | summarize n_vm = make_set(DstHostname,200) by SrcUsername, bin(TimeGenerated, 10m)
  | where array_length(n_vm) >= threshold
  | extend hostname = iff(array_length(n_vm) > 0, n_vm[0], "")
  | extend NTDomain = tostring(split(hostname, '\\', 1)[0]), HostName = tostring(split(hostname, '.', 0)[0])  
id: bdea247f-7d17-498c-ac0e-c7e764cbdbbe

ARM