Detectionmediumtest

ESXi Account Creation Via ESXCLI

Detects user account creation on ESXi system via esxcli

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Cedric MaurugeonCreated Tue Aug 22b28e4eb3-8bbc-4f0c-819f-edfe8e2f25dblinux

Log Source

LinuxProcess Creation

ProductLinux← raw: linux

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith: '/esxcli'
        CommandLine|contains|all:
            - 'system '
            - 'account '
            - 'add '
    condition: selection

False Positives

Legitimate administration activities

References

Resolving title…

developer.broadcom.com

MITRE ATT&CK

Tactics

TA0003 · Persistence TA0002 · Execution

Techniques

T1136 · Create Account

Other

attack.t1059.012

Rule Metadata

Rule ID

b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db

Status

test

Level

medium

Type

Detection

Created

Tue Aug 22

Author

Cedric Maurugeon

Path

rules/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml

Raw Tags

attack.persistenceattack.executionattack.t1136attack.t1059.012

View on GitHub