Linux Process Creation: ESXi User Account Added via esxcli system account add
Alerts when esxcli is used to run an ESXi system account add command, indicating user account creation.
- Product
- linux
- Category
- process_creation
- Author
- Cedric Maurugeon (SigmaHQ), DRL 1.1
- Published
- 2023-08-22
- Updated
- 2026-07-31
ATT&CK techniques
Execution → PersistenceRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches process executions where the command line invokes esxcli to add an ESXi system user account ("system account add"). Account creation on ESXi can enable persistence and unauthorized access, making this activity high-signal for investigation. It relies on process creation telemetry, specifically the executable path ending with /esxcli and command-line arguments containing the relevant esxcli subcommands.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux Process Creation: ESXi User Account Added via esxcli system account add"
id: 9b53cfc7-f866-43a9-9bc4-d02ee044d8b0
status: test
description: This rule matches process executions where the command line invokes esxcli to add an ESXi system user account ("system account add"). Account creation on ESXi can enable persistence and unauthorized access, making this activity high-signal for investigation. It relies on process creation telemetry, specifically the executable path ending with /esxcli and command-line arguments containing the relevant esxcli subcommands.
references:
- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml
author: Cedric Maurugeon, Huntrule Team
date: 2023-08-22
tags:
- attack.persistence
- attack.execution
- attack.t1136
- attack.t1059.012
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /esxcli
CommandLine|contains|all:
- "system "
- "account "
- "add "
condition: selection
falsepositives:
- Legitimate administration activities
level: medium
license: DRL-1.1
related:
- id: b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db
type: derived