Elastic Security Detection Rules

ESXi Host Logs Deleted with rm

Last updated 2 days ago on 2026-09-30
Created 2 days ago on 2026-09-30

About

Detects a shell `rm` of a path under `/var/log` or of a `*.log` name. Those files hold shell commands, authentication, and hostd activity. Removing them takes away the record of what changed on the host.
Tags
Domain: EndpointData Source: VMware vSphereUse Case: Threat DetectionTactic: Defense EvasionRule Type: Custom Query (KQL)Platform: VMware ESXiLanguage: kuery
Severity
high
Risk Score
73
MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Indicator Removal (T1070)(external, opens in a new tab or window)

False Positive Examples
An administrator deletes a rotated log under `/var/log` during a documented maintenance window. Confirm the path and the change ticket.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-vsphere.log-*
Related Integrations

vsphere(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset:vsphere.log and event.module:vsphere and message:(rm and ("*.log" or "/var/log/*"))

Install detection rules in Elastic Security

Detect ESXi Host Logs Deleted with rm in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).