{"id":"9691f58d-92c1-4416-8bf3-2edd753ec9cf","title":"ESXi Admin Permission Assigned To Account Via ESXCLI","description":"Detects execution of the \"esxcli\" command with the \"system\" and \"permission\" flags in order to assign admin permissions to an account.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-09-04","modified":"","tags":["attack.persistence","attack.execution","attack.privilege-escalation","attack.t1059.012","attack.t1098"],"technique_ids":["T1059.012","T1098"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate administration activities"],"references":["https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html"],"source_path":"rules/linux/process_creation/proc_creation_lnx_esxcli_permission_change_admin.yml","source_sha256":"007174648038642fcb3d2b14cf0582181d232d448d4d19712cdabaf536bad07a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_permission_change_admin.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ESXi Admin Permission Assigned To Account Via ESXCLI\nid: 9691f58d-92c1-4416-8bf3-2edd753ec9cf\nstatus: test\ndescription: Detects execution of the \"esxcli\" command with the \"system\" and \"permission\" flags in order to assign admin permissions to an account.\nreferences:\n    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-09-04\ntags:\n    - attack.persistence\n    - attack.execution\n    - attack.privilege-escalation\n    - attack.t1059.012\n    - attack.t1098\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/esxcli'\n        CommandLine|contains: 'system'\n        CommandLine|contains|all:\n            - ' permission '\n            - ' set'\n            - 'Admin'\n    condition: selection\nfalsepositives:\n    - Legitimate administration activities\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.012","id":"T1059.012","name":"Hypervisor CLI","page":"techniques/enterprise/T1059.012/"},{"key":"enterprise/T1098","id":"T1098","name":"Account Manipulation","page":"techniques/enterprise/T1098/"}],"data_path":"data/detection-rules/9691f58d-92c1-4416-8bf3-2edd753ec9cf.json","kind":"sigma"}