VMware ESXi - Root login

Back


Id	deb448a8-6a9d-4f8c-8a95-679a0a2cd62c
Rulename	VMware ESXi - Root login
Description	Detects when root user login from uncommon IP address.
Severity	High
Tactics	InitialAccess PrivilegeEscalation
Techniques	T1078
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiRootLogin.yaml
Version	1.0.3
Arm template	deb448a8-6a9d-4f8c-8a95-679a0a2cd62c.json

KQL

let p_lookback = 14d;
let t_lookback = 1h;
let root_ips = VMwareESXi
| where TimeGenerated between (ago(p_lookback) .. ago(t_lookback))
| where SyslogMessage has_all ('UserLoginSessionEvent', 'root', 'logged in')
| extend SrcIpAddr = extract(@'root@(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
| summarize makeset(SrcIpAddr);
VMwareESXi
| where TimeGenerated > ago(t_lookback)
| where SyslogMessage has_all ('UserLoginSessionEvent', 'root', 'logged in')
| extend SrcIpAddr = extract(@'root@(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
| where SrcIpAddr !in (root_ips)
| extend IPCustomEntity = SrcIpAddr

YAML

relevantTechniques:
- T1078
name: VMware ESXi - Root login
queryPeriod: 14d
triggerThreshold: 0
id: deb448a8-6a9d-4f8c-8a95-679a0a2cd62c
severity: High
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
description: |
    'Detects when root user login from uncommon IP address.'
version: 1.0.3
status: Available
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
tactics:
- InitialAccess
- PrivilegeEscalation
query: |
  let p_lookback = 14d;
  let t_lookback = 1h;
  let root_ips = VMwareESXi
  | where TimeGenerated between (ago(p_lookback) .. ago(t_lookback))
  | where SyslogMessage has_all ('UserLoginSessionEvent', 'root', 'logged in')
  | extend SrcIpAddr = extract(@'root@(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
  | summarize makeset(SrcIpAddr);
  VMwareESXi
  | where TimeGenerated > ago(t_lookback)
  | where SyslogMessage has_all ('UserLoginSessionEvent', 'root', 'logged in')
  | extend SrcIpAddr = extract(@'root@(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
  | where SrcIpAddr !in (root_ips)
  | extend IPCustomEntity = SrcIpAddr  
kind: Scheduled
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiRootLogin.yaml
queryFrequency: 1h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/deb448a8-6a9d-4f8c-8a95-679a0a2cd62c')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/deb448a8-6a9d-4f8c-8a95-679a0a2cd62c')]",
      "properties": {
        "alertRuleTemplateName": "deb448a8-6a9d-4f8c-8a95-679a0a2cd62c",
        "customDetails": null,
        "description": "'Detects when root user login from uncommon IP address.'\n",
        "displayName": "VMware ESXi - Root login",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VMWareESXi/Analytic Rules/ESXiRootLogin.yaml",
        "query": "let p_lookback = 14d;\nlet t_lookback = 1h;\nlet root_ips = VMwareESXi\n| where TimeGenerated between (ago(p_lookback) .. ago(t_lookback))\n| where SyslogMessage has_all ('UserLoginSessionEvent', 'root', 'logged in')\n| extend SrcIpAddr = extract(@'root@(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})', 1, SyslogMessage)\n| summarize makeset(SrcIpAddr);\nVMwareESXi\n| where TimeGenerated > ago(t_lookback)\n| where SyslogMessage has_all ('UserLoginSessionEvent', 'root', 'logged in')\n| extend SrcIpAddr = extract(@'root@(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})', 1, SyslogMessage)\n| where SrcIpAddr !in (root_ips)\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}