Linux Process Creating esxcli System Permission Set Admin for an Account

Alerts when esxcli is run to set Admin permissions via the system/permission set flags.

FreeReviewedSigma · High · v3

Product: linux
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-09-04
Updated: 2026-07-31

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1059Command and Scripting Interpreter
Persistence
- T1098Account Manipulation
Priv Esc
- T1098Account Manipulation
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches process executions of the esxcli binary on Linux where the command line includes the system context and performs a permission set action for an Admin role on an account. Assigning administrative permissions can enable persistence or privilege escalation by granting elevated access to identities used for later actions. It relies on process creation telemetry, specifically the executable path and command-line arguments containing the required substrings.

Reporting behind it

Related detections9 linkedT1098 — drag to rearrange

Malicious Web Server Process Spawning Command Interpreter via Web Shell (via process_creation)

Suspicious VMware Guest Operation Output Staging in vmware-system Temp Directory (via file_event)

Suspicious Route53 Domain Transfer Lock Disabled via Scattered Spider Technique

Suspicious Domain Admin Account Creation via net (via process_creation)

Suspicious Guest Account Privilege Escalation (via process_creation)

Suspicious Login Shell Assigned to Service Account games on Linux

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Suspicious dMSA Object Access with Migration AccessMask

Suspicious Script Interpreter Spawned by Excel via DarkGate Lure

Linux Process Creating esxcli System Permission Set Admin for an Account

Pivot detection · T1098 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-esxi-esxcli-used-to-set-admin-permission-on-an-account-9691f58d

title: Linux Process Creating esxcli System Permission Set Admin for an Account
id: fa5400a4-1328-4835-8c7f-bf197f09e81f
status: test
description: This rule matches process executions of the esxcli binary on Linux where the command line includes the system context and performs a permission set action for an Admin role on an account. Assigning administrative permissions can enable persistence or privilege escalation by granting elevated access to identities used for later actions. It relies on process creation telemetry, specifically the executable path and command-line arguments containing the required substrings.
references:
  - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_permission_change_admin.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-04
tags:
  - attack.persistence
  - attack.execution
  - attack.privilege-escalation
  - attack.t1059.012
  - attack.t1098
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /esxcli
    CommandLine|contains: system
    CommandLine|contains|all:
      - " permission "
      - " set"
      - Admin
  condition: selection
falsepositives:
  - Legitimate administration activities
level: high
license: DRL-1.1
related:
  - id: 9691f58d-92c1-4416-8bf3-2edd753ec9cf
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL