esxi:logs
ESXi and vCenter logs
hostd, vmkernel, shell, auth, vpxd, vobd, syslog
- Host type
- VMware ESXi / vCenter
- Tier, as a whole
- Minimum
- Techniques
- 105
- Rules listed
- 48
- Events
- 0
Why this tier
OMB M-26-14 A5 (Infrastructure changes; our analysis)
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Infrastructure changes | Supports an activity | our analysis: VM lifecycle |
Techniques
- T1001.001 Junk Data
- T1001.002 Steganography
- T1001.003 Protocol or Service Impersonation
- T1005 Data from Local System
- T1008 Fallback Channels
- T1016 System Network Configuration Discovery
- T1016.001 Internet Connection Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1021.004 SSH
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1037 Boot or Logon Initialization Scripts
- T1037.004 RC Scripts
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol
- T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1049 System Network Connections Discovery
- T1053 Scheduled Task/Job
- T1053.003 Cron
- T1057 Process Discovery
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1059.006 Python
- T1059.012 Hypervisor CLI
- T1070 Indicator Removal
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1070.009 Clear Persistence
- T1071.001 Web Protocols
- T1071.002 File Transfer Protocols
- T1071.004 DNS
- T1074 Data Staged
- T1074.001 Local Data Staging
- T1074.002 Remote Data Staging
- T1078.001 Default Accounts
- T1078.002 Domain Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1087.001 Local Account
- T1090 Proxy
- T1090.001 Internal Proxy
- T1090.002 External Proxy
- T1090.003 Multi-hop Proxy
- T1090.004 Domain Fronting
- T1095 Non-Application Layer Protocol
- T1098 Account Manipulation
- T1098.004 SSH Authorized Keys
- T1102 Web Service
- T1102.001 Dead Drop Resolver
- T1102.003 One-Way Communication
- T1104 Multi-Stage Channels
- T1105 Ingress Tool Transfer
- T1124 System Time Discovery
- T1132 Data Encoding
- T1132.001 Standard Encoding
- T1132.002 Non-Standard Encoding
- T1136.001 Local Account
- T1190 Exploit Public-Facing Application
- T1210 Exploitation of Remote Services
- T1222 File and Directory Permissions Modification
- T1480 Execution Guardrails
- T1485 Data Destruction
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1491 Defacement
- T1491.001 Internal Defacement
- T1505 Server Software Component
- T1505.006 vSphere Installation Bundles
- T1518 Software Discovery
- T1529 System Shutdown/Reboot
- T1531 Account Access Removal
- T1554 Compromise Host Software Binary
- T1564 Hide Artifacts
- T1564.006 Run Virtual Instance
- T1567 Exfiltration Over Web Service
- T1567.001 Exfiltration to Code Repository
- T1567.002 Exfiltration to Cloud Storage
- T1567.003 Exfiltration to Text Storage Sites
- T1567.004 Exfiltration Over Webhook
- T1568 Dynamic Resolution
- T1568.001 Fast Flux DNS
- T1568.002 Domain Generation Algorithms
- T1568.003 DNS Calculation
- T1570 Lateral Tool Transfer
- T1571 Non-Standard Port
- T1572 Protocol Tunneling
- T1573 Encrypted Channel
- T1573.001 Symmetric Cryptography
- T1573.002 Asymmetric Cryptography
- T1611 Escape to Host
- T1654 Log Enumeration
- T1665 Hide Infrastructure
- T1673 Virtual Machine Discovery
- T1675 ESXi Administration Command
- T1680 Local Storage Discovery
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1690 Prevent Command History Logging
Rules
Splunk 23
- ESXi Account Modified
- ESXi Audit Tampering
- ESXi Bulk VM Termination
- ESXi Download Errors
- ESXi Encryption Settings Modified
- ESXi External Root Login Activity
- ESXi Firewall Disabled
- ESXi Lockdown Mode Disabled
- ESXi Loghost Config Tampering
- ESXi Malicious VIB Forced Install
- ESXi Reverse Shell Patterns
- ESXi SSH Brute Force
- ESXi SSH Enabled
- ESXi Sensitive Files Accessed
- ESXi Shared or Stolen Root Account
- ESXi Shell Access Enabled
- ESXi Syslog Config Change
- ESXi System Clock Manipulation
- ESXi System Information Discovery
- ESXi User Granted Admin Role
- ESXi VIB Acceptance Level Tampering
- ESXi VM Discovery
- ESXi VM Exported via Remote Tool
Elastic 25
- ESXi Account Granted Admin Role
- ESXi Attempt to Force Install a VMware VIB Package
- ESXi Audit Records Disabled
- ESXi Curl or Wget Activity
- ESXi ExecInstalledOnly Protection Disabled
- ESXi File Made Executable with chmod
- ESXi Firewall Disabled
- ESXi Host Logs Deleted with rm
- ESXi Host Prepared for an Unsigned Install
- ESXi Local Account Created
- ESXi Lockdown Mode Disabled
- ESXi Multiple Logon Failures by User and Source
- ESXi Payload Executed Against Datastore
- ESXi Root Password Accepted from Remote Host
- ESXi Root Password Changed
- ESXi SSH Access Enabled
- ESXi SSH Session from vpxuser
- ESXi Shell Command Obfuscation
- ESXi Syslog Remote Host Reset
- ESXi System and Account Enumeration
- ESXi Virtual Disk Files Enumerated
- ESXi Virtual Machine Powered Off
- ESXi Virtual Machine Process Killed
- ESXi Virtual Machine Process List
- ESXi Virtual Machine Snapshot Removed
Events
No event-level rows: this source is tiered as a whole.