ESXi Root Password Changed

[metadata]
creation_date = "2026/09/30"
integration = ["vsphere"]
maturity = "production"
updated_date = "2026/09/30"

[rule]
author = ["Elastic"]
description = """
Detects a change to the ESXi root password, the credential for SSH, the Host Client, and the API.
Replacing it locks out the previous password and gives the new value full control of the host.
Hostd records `Password was changed for account root`. The shell records `esxcli system account set -i root`.
"""
false_positives = [
    """
    Administrators rotate the root password during scheduled maintenance. Confirm the change ticket and
    that the new password was stored with the approved break-glass process.
    """,
]
from = "now-9m"
index = ["logs-vsphere.log-*"]
language = "kuery"
license = "Elastic License v2"
name = "ESXi Root Password Changed"
note = """## Triage and analysis

### Investigating ESXi Root Password Changed

The root account is the local administrator on a standalone ESXi host. A password change keeps the same account and replaces the credential used for SSH, the Host Client, and the API.

#### Possible investigation steps

- Read message for Password was changed for account root or esxcli system account set -i root.
- Note the account in the hostd user field. That is who performed the change.
- Check the same session for lockdown mode being disabled, a new local account, or an Admin role grant.
- Ask whether the new password was recorded in the approved secret store.

### False positive analysis

A documented root password rotation is commonly benign. An unplanned change, especially after lockdown mode was disabled, deserves review.

### Response and remediation

- If the change was not approved, set a new root password and store it with the break-glass process.
- Review other account and permission changes from the same session.
- Preserve hostd.log and shell.log before closing the session.
"""
references = [
    "https://lolesxi-project.github.io/LOLESXi/#",
    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
]
setup = """## Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
"""
risk_score = 47
rule_id = "44d5aacb-8e56-5819-8ba3-5e397691fdc8"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "Data Source: VMware vSphere",
    "Use Case: Threat Detection",
    "Tactic: Persistence",
    "Resources: Investigation Guide",
    "Rule Type: Custom Query (KQL)",
    "Platform: VMware ESXi",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:vsphere.log and event.module:vsphere and message:("Password was changed for account root" or "-i root" and "esxcli system account set")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"

[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "message",
    "event.original",
    "host.hostname",
    "log.file.path",
]