Linux Process: ESXi esxcli Used to Set Admin Permission on an Account

Alerts when esxcli is run to set Admin permissions via the system/permission set flags.

FreeUnreviewedSigmahighv1

linux-process-esxi-esxcli-used-to-set-admin-permission-on-an-account-9691f58d

title: "Linux Process: ESXi esxcli Used to Set Admin Permission on an Account"
id: fa5400a4-1328-4835-8c7f-bf197f09e81f
status: test
description: This rule flags execution of the esxcli command on Linux where the command line includes the system context and a permission set operation targeting Admin privileges for an account. Attackers can use ESXi management tooling to persistently grant elevated rights, enabling administrative access without exploiting OS-level vulnerabilities. The detection relies on process creation telemetry, matching the esxcli binary path and specific command-line substrings indicating a permission assignment and Admin targeting.
references:
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_permission_change_admin.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-04
tags:
  - attack.persistence
  - attack.execution
  - attack.privilege-escalation
  - attack.t1059.012
  - attack.t1098
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /esxcli
    CommandLine|contains: system
    CommandLine|contains|all:
      - " permission "
      - " set"
      - Admin
  condition: selection
falsepositives:
  - Legitimate administration activities
level: high
license: DRL-1.1
related:
  - id: 9691f58d-92c1-4416-8bf3-2edd753ec9cf
    type: derived

What it detects

This rule flags execution of the esxcli command on Linux where the command line includes the system context and a permission set operation targeting Admin privileges for an account. Attackers can use ESXi management tooling to persistently grant elevated rights, enabling administrative access without exploiting OS-level vulnerabilities. The detection relies on process creation telemetry, matching the esxcli binary path and specific command-line substrings indicating a permission assignment and Admin targeting.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.