ESXi System and Account Enumeration

[metadata]
creation_date = "2026/09/30"
integration = ["vsphere"]
maturity = "production"
updated_date = "2026/09/30"

[rule]
author = ["Elastic"]
description = """
Detects shell commands that collect ESXi host details or the local account list, including `uname -a`, system
version, hostname, and `esxcli system account list`. The output identifies the build and the accounts that can
log in. Listing accounts shows which identities exist before one of them is changed or used.
"""
false_positives = [
    """
    Administrators run these commands during inventory, troubleshooting, and support. Review whether the same session
continues into virtual machine shutdown, snapshot removal, or a datastore search.
    """,
]
from = "now-9m"
index = ["logs-vsphere.log-*"]
language = "kuery"
license = "Elastic License v2"
name = "ESXi System and Account Enumeration"
note = """## Triage and analysis

### Investigating ESXi System and Account Enumeration

These commands collect the OS build, product version, hostname, or the local account list. Account listing is the higher-interest command. Version and hostname checks are common on their own.

#### Possible investigation steps

- Read message to see which command ran.
- Check the same session for vm process list, vm process kill, chmod, or a search under /vmfs/volumes.
- For esxcli system account list, compare the listed accounts with the known set for that host.

### False positive analysis

A single version or hostname check during maintenance is commonly benign. Several of these commands in one session, especially account listing followed by VM shutdown, deserves review.

### Response and remediation

- If the same session kills virtual machines or writes a file under /tmp, isolate the host.
- Otherwise record the account and source for hunting on other hosts.
"""
references = [
    "https://lolesxi-project.github.io/LOLESXi/#",
    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
]
setup = """## Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
"""
risk_score = 21
rule_id = "5173b00b-9546-5925-862a-a93e43472b29"
severity = "low"
tags = [
    "Domain: Endpoint",
    "Data Source: VMware vSphere",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
    "Rule Type: Custom Query (KQL)",
    "Platform: VMware ESXi",
    "Threat: Ransomware",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset: "vsphere.log" and event.module: "vsphere" and 
message: (
  "uname -a" or
  "esxcli system version get" or
  "esxcli system hostname get" or
  "esxcli system account list"
)
'''

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1082"
name = "System Information Discovery"
reference = "https://attack.mitre.org/techniques/T1082/"

[[rule.threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[rule.threat.technique.subtechnique]]
id = "T1087.001"
name = "Local Account"
reference = "https://attack.mitre.org/techniques/T1087/001/"

[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "message",
    "event.original",
    "host.hostname",
    "log.file.path",
]