Impact

Unauthorized local accounts provide persistent access to the ESXi hypervisor, enabling potential lateral movement, data exfiltration, or deployment of ransomware by threat actors who have gained initial management access.

Recommendation

• Deploy log collection for VMware ESXi using the Elastic vSphere integration to ensure visibility into hostd and shell execution logs.
• Establish a baseline of authorized administrative accounts for all ESXi hosts.
• Monitor for the creation of local accounts (esxcli system account add) or logs indicating an account was created on a host.
• Investigate any account creation not tied to documented onboarding or break-glass procedures by identifying the user who performed the action and checking for subsequent assignment of administrative roles.