{"id":"b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db","title":"ESXi Account Creation Via ESXCLI","description":"Detects user account creation on ESXi system via esxcli","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-08-22","modified":"","tags":["attack.persistence","attack.execution","attack.t1136","attack.t1059.012"],"technique_ids":["T1059.012","T1136"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate administration activities"],"references":["https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html"],"source_path":"rules/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml","source_sha256":"487a4c1c9589e5bac38067c856a9496b247204b3a62588e76dcf1a6f3005265f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ESXi Account Creation Via ESXCLI\nid: b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db\nstatus: test\ndescription: Detects user account creation on ESXi system via esxcli\nreferences:\n    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html\nauthor: Cedric Maurugeon\ndate: 2023-08-22\ntags:\n    - attack.persistence\n    - attack.execution\n    - attack.t1136\n    - attack.t1059.012\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|endswith: '/esxcli'\n        CommandLine|contains|all:\n            - 'system '\n            - 'account '\n            - 'add '\n    condition: selection\nfalsepositives:\n    - Legitimate administration activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.012","id":"T1059.012","name":"Hypervisor CLI","page":"techniques/enterprise/T1059.012/"},{"key":"enterprise/T1136","id":"T1136","name":"Create Account","page":"techniques/enterprise/T1136/"}],"data_path":"data/detection-rules/b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db.json","kind":"sigma"}