VMware ESXi - Root login

Back


Id	deb448a8-6a9d-4f8c-8a95-679a0a2cd62c
Rulename	VMware ESXi - Root login
Description	Detects when root user login from uncommon IP address.
Severity	High
Tactics	InitialAccess PrivilegeEscalation
Techniques	T1078
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiRootLogin.yaml
Version	1.0.3
Arm template	deb448a8-6a9d-4f8c-8a95-679a0a2cd62c.json

KQL

let p_lookback = 14d;
let t_lookback = 1h;
let root_ips = VMwareESXi
| where TimeGenerated between (ago(p_lookback) .. ago(t_lookback))
| where SyslogMessage has_all ('UserLoginSessionEvent', 'root', 'logged in')
| extend SrcIpAddr = extract(@'root@(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
| summarize makeset(SrcIpAddr);
VMwareESXi
| where TimeGenerated > ago(t_lookback)
| where SyslogMessage has_all ('UserLoginSessionEvent', 'root', 'logged in')
| extend SrcIpAddr = extract(@'root@(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
| where SrcIpAddr !in (root_ips)
| extend IPCustomEntity = SrcIpAddr

YAML

description: |
    'Detects when root user login from uncommon IP address.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiRootLogin.yaml
queryFrequency: 1h
version: 1.0.3
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
status: Available
query: |
  let p_lookback = 14d;
  let t_lookback = 1h;
  let root_ips = VMwareESXi
  | where TimeGenerated between (ago(p_lookback) .. ago(t_lookback))
  | where SyslogMessage has_all ('UserLoginSessionEvent', 'root', 'logged in')
  | extend SrcIpAddr = extract(@'root@(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
  | summarize makeset(SrcIpAddr);
  VMwareESXi
  | where TimeGenerated > ago(t_lookback)
  | where SyslogMessage has_all ('UserLoginSessionEvent', 'root', 'logged in')
  | extend SrcIpAddr = extract(@'root@(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
  | where SrcIpAddr !in (root_ips)
  | extend IPCustomEntity = SrcIpAddr  
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
kind: Scheduled
severity: High
tactics:
- InitialAccess
- PrivilegeEscalation
id: deb448a8-6a9d-4f8c-8a95-679a0a2cd62c
triggerOperator: gt
relevantTechniques:
- T1078
queryPeriod: 14d
name: VMware ESXi - Root login
triggerThreshold: 0

ARM