ESXi user account creation via esxcli command execution

title: ESXi user account creation via esxcli command execution
id: 9b53cfc7-f866-43a9-9bc4-d02ee044d8b0
status: test
description: This rule flags process executions of esxcli where the command line includes the system, account, and add keywords, indicating an attempt to create a user account on an ESXi host. Attackers may use this capability to establish persistence or regain access by adding new credentials. Detection relies on Linux process creation telemetry capturing the executed image path and the full command line arguments.
references:
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml
author: Cedric Maurugeon, Huntrule Team
date: 2023-08-22
tags:
  - attack.persistence
  - attack.execution
  - attack.t1136
  - attack.t1059.012
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /esxcli
    CommandLine|contains|all:
      - "system "
      - "account "
      - "add "
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db
    type: derived