ESXi Syslog Configuration Change via esxcli on Linux

Detects esxcli commands that set ESXi syslog configuration based on command-line terms.

FreeUnreviewedSigmamediumv1

esxi-syslog-configuration-change-via-esxcli-on-linux-38eb1dbb

title: ESXi Syslog Configuration Change via esxcli on Linux
id: 5ee260a4-1ac2-440c-b8ea-1a0071a21c98
status: test
description: This rule flags process executions where the command invokes esxcli and includes arguments targeting ESXi system syslog configuration (i.e., containing terms for system, syslog, config, and setting parameters). Attackers and administrators can use esxcli to alter logging behavior to impair detection or redirect where syslog events are sent. The detection relies on process creation telemetry, matching the esxcli executable path and specific command-line substrings.
references:
  - https://support.solarwinds.com/SuccessCenter/s/article/Configure-ESXi-Syslog-to-LEM?language=en_US
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_syslog_config_change.yml
author: Cedric Maurugeon, Huntrule Team
date: 2023-09-04
tags:
  - attack.execution
  - attack.defense-impairment
  - attack.t1685
  - attack.t1690
  - attack.t1059.012
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /esxcli
    CommandLine|contains|all:
      - system
      - syslog
      - config
    CommandLine|contains: " set"
  condition: selection
falsepositives:
  - Legitimate administrative activities
level: medium
license: DRL-1.1
related:
  - id: 38eb1dbb-011f-40b1-a126-cf03a0210563
    type: derived

What it detects

This rule flags process executions where the command invokes esxcli and includes arguments targeting ESXi system syslog configuration (i.e., containing terms for system, syslog, config, and setting parameters). Attackers and administrators can use esxcli to alter logging behavior to impair detection or redirect where syslog events are sent. The detection relies on process creation telemetry, matching the esxcli executable path and specific command-line substrings.

Known false positives

Legitimate administrative activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.