ESXi SSH Access Enabled

Last updated 2 days ago on 2026-09-30

Created 2 days ago on 2026-09-30

About

Detects ESXi SSH being turned on. SSH is often left disabled so the host is managed through the local console, the Host Client, or vCenter. Enabling it opens a remote shell that can copy files onto the host and run commands against the datastore.

Tags

Domain: EndpointData Source: VMware vSphereUse Case: Threat DetectionTactic: Lateral MovementRule Type: Custom Query (KQL)Platform: VMware ESXiLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Lateral Movement (TA0008)(external, opens in a new tab or window)

↳ Remote Services (T1021)(external, opens in a new tab or window)

False Positive Examples

Administrators enable SSH for a documented troubleshooting window. ESXi often disables the service again on reboot, so a later enable by a known operator can be expected.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-vsphere.log-*
Related Integrations: vsphere(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset:vsphere.log and message:("SSH access has been enabled" or "hostsvc/enable_ssh")

Install detection rules in Elastic Security

Detect ESXi SSH Access Enabled in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).