ESXi Multiple Logon Failures by User and Source

[metadata]
creation_date = "2026/09/30"
integration = ["vsphere"]
maturity = "production"
updated_date = "2026/09/30"

[rule]
author = ["Elastic"]
description = """
Detects three or more failed ESXi logons for the same account from the same remote address within 10 minutes.
Hostd records each failure from `pam_do_authenticate` with the login name and `rhost`. Repeated failures from
one source are password guessing against that account and can lock it or come just before a successful login.
"""
false_positives = [
    """
    An administrator who mistypes the root password in the Host Client a few times can reach three failures.
    Confirm the source address is a known workstation and that a successful login did not follow.
    """,
]
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "ESXi Multiple Logon Failures by User and Source"
note = """## Triage and analysis

### Investigating ESXi Multiple Logon Failures by User and Source

Each failed Host Client or API logon is a hostd line pam_do_authenticate: error with rhost=<address> and
login:<account>. The query uses GROK to take those two values from message, then counts failures for the
same account and remote address. The rule lookback is 9 minutes, and the alert requires at least 3 failures
within 10 minutes apart.

#### Possible investigation steps

- Read user.name, source.ip, and Esql.failure_count.
- Compare source.ip with known jump hosts and administrator workstations.
- Look for a following Accepted password for user for the same account from that address.
- On the host, check whether the account is locked: esxcli system account list.

### False positive analysis

A short run of mistyped passwords from one workstation is commonly benign. Failures from an unknown address, or failures followed by a successful login, deserve review.

### Response and remediation

- If the source is not approved, block it and rotate the targeted account password.
- Unlock the account if the lockout threshold was reached and the activity was not approved.
- Preserve hostd.log for the source address and account.
"""
references = [
    "https://lolesxi-project.github.io/LOLESXi/#",
    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
]
setup = """## Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
"""
risk_score = 47
rule_id = "0e8c4128-43b9-53ee-804d-a98657a30964"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "Data Source: VMware vSphere",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
    "Rule Type: ES|QL",
    "Platform: VMware ESXi",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
FROM logs-vsphere.log-*
| WHERE data_stream.dataset == "vsphere.log" AND event.module == "vsphere"
    AND message LIKE "*pam_do_authenticate: error*"
| GROK message "%{DATA}rhost=%{IP:source_ip}%{DATA}login:%{DATA:user}]%{GREEDYDATA}"
| WHERE user IS NOT NULL AND source_ip IS NOT NULL
| EVAL user.name = user, source.ip = source_ip
| STATS
    Esql.failure_count = COUNT(*),
    Esql.first_seen = MIN(@timestamp),
    Esql.last_seen = MAX(@timestamp),
    Esql.message_values = VALUES(message)
  BY user.name, source.ip, host.ip
| WHERE Esql.failure_count >= 3
| EVAL message = MV_FIRST(Esql.message_values)
| KEEP message, user.name, source.ip, host.ip, Esql.failure_count, Esql.first_seen, Esql.last_seen, Esql.message_values
'''

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1110"
name = "Brute Force"
reference = "https://attack.mitre.org/techniques/T1110/"
[[rule.threat.technique.subtechnique]]
id = "T1110.001"
name = "Password Guessing"
reference = "https://attack.mitre.org/techniques/T1110/001/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule.investigation_fields]
field_names = [
    "user.name",
    "source.ip",
    "message",
    "host.ip",
    "Esql.failure_count",
    "Esql.first_seen",
    "Esql.last_seen"
]