Elastic Security Detection Rules

ESXi ExecInstalledOnly Protection Disabled

Last updated 2 days ago on 2026-09-30
Created 2 days ago on 2026-09-30

About

Detects ESXi ExecInstalledOnly protection being turned off. The setting limits execution to binaries that were installed by a VIB and have not been modified. When it is set to false, the host can run files from paths such as `/tmp` that were never part of the system image.
Tags
Domain: EndpointData Source: VMware vSphereUse Case: Threat DetectionTactic: Defense EvasionRule Type: Custom Query (KQL)Platform: VMware ESXiLanguage: kuery
Severity
high
Risk Score
73
MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Impair Defenses (T1562)(external, opens in a new tab or window)

False Positive Examples
Some recovery and lab images leave ExecInstalledOnly off, and an approved change can disable it while a custom VIB is installed. Confirm the setting is restored to TRUE afterward.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-vsphere.log-*
Related Integrations

vsphere(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset:vsphere.log and event.module:vsphere and message:(execInstalledOnly and ("-i 0" or "-v 0" or FALSE))

Install detection rules in Elastic Security

Detect ESXi ExecInstalledOnly Protection Disabled in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).