T1078 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/t1078/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000ESXi External Root Login Activity Detectionhttps://feed.craftedsignal.io/briefs/2024-01-esxi-root-login/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-esxi-root-login/Detection of ESXi UI access using the root account from external IP addresses, bypassing role-based access controls and potentially indicating unauthorized activity or compromised credentials.This brief addresses the risk of unauthorized access to VMware ESXi hosts through direct root login activity. The focus is on detecting instances where the ESXi UI is accessed using the root account from IP addresses outside of defined internal ranges. This activity is flagged because it bypasses role-based access controls and standard auditing practices, raising the potential for misconfiguration, unauthorized actions, or even a malicious actor leveraging compromised credentials to gain control of the ESXi host. The detection logic relies on analyzing ESXi syslog data, specifically looking for login events associated with the "root" user. By excluding internal IP ranges, the detection aims to highlight potentially suspicious external access attempts. Identifying and responding to such activity promptly is critical for maintaining the integrity and security of the virtualized environment and preventing further exploitation.

Attack Chain

  1. Attacker gains initial access to network, potentially through phishing or exploiting a vulnerable service.
  2. Attacker performs network reconnaissance to identify ESXi hosts and their IP addresses.
  3. Attacker attempts to access the ESXi UI using the root account, likely through brute-force or credential stuffing attacks.
  4. ESXi host logs the successful root login event in the syslog.
  5. The syslog message contains the source IP address of the attacker and the hostname of the ESXi host.
  6. The security monitoring system ingests the syslog data and triggers an alert based on the detection rule.
  7. Attacker gains full administrative control of the ESXi host, allowing them to create, modify, or delete virtual machines.
  8. The attacker can then leverage the compromised ESXi host to move laterally within the network, deploy ransomware, or exfiltrate sensitive data.

Impact

Compromise of an ESXi host grants an attacker significant control over the virtualized environment. This can lead to the theft or destruction of sensitive data stored on virtual machines, disruption of critical services, and further lateral movement within the network. Depending on the size and scope of the virtualized infrastructure, this could impact dozens or even hundreds of virtual machines. The "Black Basta Ransomware" analytic story tag indicates that this activity is relevant to ransomware attacks, where attackers might target ESXi hosts to encrypt virtual machines for extortion.

Recommendation

  • Configure ESXi hosts to forward syslog output to a centralized logging server, ensuring comprehensive logging of security events (VMWare ESXi Syslog data_source).
  • Deploy the provided Sigma rule ESXi External Root Login to your SIEM to detect unauthorized root login attempts from external IP addresses. Tune the rule's IP address exclusions to match your organization's internal network ranges.
  • Investigate all alerts generated by the Sigma rule, focusing on the source IP address and the accessed ESXi host to determine the legitimacy of the login attempt.
  • Implement multi-factor authentication (MFA) for all ESXi administrative accounts to mitigate the risk of credential compromise.
  • Review and enforce strong password policies for all ESXi accounts, including the root account.
  • Restrict network access to the ESXi UI to only authorized IP addresses or networks using firewall rules.
]]>highadvisoryesxivmwareroot_loginunauthorized_accesst1078