Elastic Security Detection Rules

ESXi System and Account Enumeration

Last updated 2 days ago on 2026-09-30
Created 2 days ago on 2026-09-30

About

Detects shell commands that collect ESXi host details or the local account list, including `uname -a`, system version, hostname, and `esxcli system account list`. The output identifies the build and the accounts that can log in. Listing accounts shows which identities exist before one of them is changed or used.
Tags
Domain: EndpointData Source: VMware vSphereUse Case: Threat DetectionTactic: DiscoveryRule Type: Custom Query (KQL)Platform: VMware ESXiThreat: RansomwareLanguage: kuery
Severity
low
Risk Score
21
MITRE ATT&CK™

Discovery (TA0007)(external, opens in a new tab or window)

↳ System Information Discovery (T1082)(external, opens in a new tab or window)

↳ Account Discovery (T1087)(external, opens in a new tab or window)

False Positive Examples
Administrators run these commands during inventory, troubleshooting, and support. Review whether the same session continues into virtual machine shutdown, snapshot removal, or a datastore search.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-vsphere.log-*
Related Integrations

vsphere(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset: "vsphere.log" and event.module: "vsphere" and 
message: (
  "uname -a" or
  "esxcli system version get" or
  "esxcli system hostname get" or
  "esxcli system account list"
)

Install detection rules in Elastic Security

Detect ESXi System and Account Enumeration in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).