ESXi Root Password Accepted from Remote Host

[metadata]
creation_date = "2026/09/30"
integration = ["vsphere"]
maturity = "production"
updated_date = "2026/09/30"

[rule]
author = ["Elastic"]
description = """
Detects hostd accepting the ESXi root password from a remote address. A successful remote root login opens the
Host Client or the API with full control of the host. Local sessions from 127.0.0.1 are left out of the rule.
"""
false_positives = [
    """
    Administrators sign in to the Host Client or the API as root from a jump host during maintenance. Confirm the
source address is a known workstation and that the session does not continue into SSH enablement, file copies to
`/tmp`, or virtual machine shutdowns.
    """,
]
from = "now-9m"
index = ["logs-vsphere.log-*"]
language = "kuery"
license = "Elastic License v2"
name = "ESXi Root Password Accepted from Remote Host"
note = """## Triage and analysis

### Investigating ESXi Root Password Accepted from Remote Host

Vimsvc.HaSessionManager writes this line when a root password is accepted. The source after from is the client address. A remote address is a direct HTTPS login to the host. from 127.0.0.1 is local esxcli and is not part of this rule. vpxuser from 127.0.0.1 is the host's own client.

#### Possible investigation steps

- Read the source address in message. Compare it with known admin workstations.
- In the same sid and opID, look for the following User root@<ip> logged in event and for SSH access has been enabled.
- Check later shell commands for chmod, /tmp, and /vmfs/volumes.

### False positive analysis

A documented Host Client login as root from the admin network can be benign. A root acceptance from an unexpected address, followed by SSH being enabled, is the lateral-movement pattern.

### Response and remediation

- If the source was not approved, disable the session, rotate the root password, and review accounts created in that window.
- Preserve hostd.log for the sid on the event.
- Hunt other hosts for Accepted password for user root from the same source address.
"""
references = [
    "https://lolesxi-project.github.io/LOLESXi/#",
    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
]
setup = """## Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
"""
risk_score = 47
rule_id = "b4837b9b-db8b-5b7c-afa5-599202651b10"
severity = "medium"
tags = [
    "Domain: Endpoint",
    "Data Source: VMware vSphere",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Resources: Investigation Guide",
    "Rule Type: Custom Query (KQL)",
    "Platform: VMware ESXi",
    "Threat: Ransomware",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:vsphere.log and event.module:vsphere and message:("Accepted password for user root" and not "from 127.0.0.1")
'''

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"
[[rule.threat.technique.subtechnique]]
id = "T1078.001"
name = "Default Accounts"
reference = "https://attack.mitre.org/techniques/T1078/001/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "message",
    "event.original",
    "host.hostname",
    "log.file.path",
]