VMware ESXi: Unauthorized local account creation detection

Local account creation on VMware ESXi hosts serves as a persistence mechanism that survives session termination. Unauthorized accounts, often created via the Host Client or esxcli system commands, are a known precursor to hypervisor-level control, particularly in ransomware campaigns. Organizations should audit account creation events against expected administrative activity.

Impact

Unauthorized local accounts provide persistent access to the ESXi hypervisor, enabling potential lateral movement, data exfiltration, or deployment of ransomware by threat actors who have gained initial management access.

Recommendation

• Deploy log collection for VMware ESXi using the Elastic vSphere integration to ensure visibility into hostd and shell execution logs.
• Establish a baseline of authorized administrative accounts for all ESXi hosts.
• Monitor for the creation of local accounts (esxcli system account add) or logs indicating an account was created on a host.
• Investigate any account creation not tied to documented onboarding or break-glass procedures by identifying the user who performed the action and checking for subsequent assignment of administrative roles.