{"id":"38eb1dbb-011f-40b1-a126-cf03a0210563","title":"ESXi Syslog Configuration Change Via ESXCLI","description":"Detects changes to the ESXi syslog configuration via \"esxcli\"","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":"","tags":["attack.execution","attack.defense-impairment","attack.t1685","attack.t1690","attack.t1059.012"],"technique_ids":["T1059.012","T1685","T1690"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate administrative activities"],"references":["https://support.solarwinds.com/SuccessCenter/s/article/Configure-ESXi-Syslog-to-LEM?language=en_US","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html"],"source_path":"rules/linux/process_creation/proc_creation_lnx_esxcli_syslog_config_change.yml","source_sha256":"eac0c07f67091c593b312590e97b422272ccfb1ad1c41a510a7326607f55c6a8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_syslog_config_change.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ESXi Syslog Configuration Change Via ESXCLI\nid: 38eb1dbb-011f-40b1-a126-cf03a0210563\nstatus: test\ndescription: Detects changes to the ESXi syslog configuration via \"esxcli\"\nreferences:\n    - https://support.solarwinds.com/SuccessCenter/s/article/Configure-ESXi-Syslog-to-LEM?language=en_US\n    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html\nauthor: Cedric Maurugeon\ndate: 2023-09-04\ntags:\n    - attack.execution\n    - attack.defense-impairment\n    - attack.t1685\n    - attack.t1690\n    - attack.t1059.012\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/esxcli'\n        CommandLine|contains|all:\n            - 'system'\n            - 'syslog'\n            - 'config'\n        CommandLine|contains: ' set'\n    condition: selection\nfalsepositives:\n    - Legitimate administrative activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.012","id":"T1059.012","name":"Hypervisor CLI","page":"techniques/enterprise/T1059.012/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"},{"key":"enterprise/T1690","id":"T1690","name":"Prevent Command History Logging","page":"techniques/enterprise/T1690/"}],"data_path":"data/detection-rules/38eb1dbb-011f-40b1-a126-cf03a0210563.json","kind":"sigma"}