---
title: ESXi ExecInstalledOnly Protection Disabled
description: Detects ESXi ExecInstalledOnly protection being turned off. The setting limits execution to binaries that were installed by a VIB and have not been modified...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_execinstalledonly_protection_disabled
products:
  - Elastic Security
---

# ESXi ExecInstalledOnly Protection Disabled
Detects ESXi ExecInstalledOnly protection being turned off. The setting limits execution to binaries that were
installed by a VIB and have not been modified. When it is set to false, the host can run files from paths such
as `/tmp` that were never part of the system image.
**Rule type**: query
**Rule indices**:
- logs-vsphere.log-*

**Rule Severity**: high
**Risk Score**: 73
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://lolesxi-project.github.io/LOLESXi/#](https://lolesxi-project.github.io/LOLESXi/#)](https://lolesxi-project.github.io/LOLESXi/#)
- [[https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html](https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html)](https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html)
- [[https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21](https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21)](https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21)

**Tags**:
- Domain: Endpoint
- Data Source: VMware vSphere
- Use Case: Threat Detection
- Tactic: Defense Evasion
- Resources: Investigation Guide
- Rule Type: Custom Query (KQL)
- Platform: VMware ESXi

**Version**: 1
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: [https://www.elastic.co/docs/reference/integrations/vsphere](https://www.elastic.co/docs/reference/integrations/vsphere)

## Investigation guide


## Triage and analysis


### Investigating ESXi ExecInstalledOnly Protection Disabled

ExecInstalledOnly limits execution to binaries that were installed by a VIB and have not been modified. Turning it off lets a later payload run from a path such as /tmp.

#### Possible investigation steps

- Read message for execInstalledOnly set to FALSE, or /User/ExecInstalledOnly set with -i 0.
- On the host, run esxcli system settings kernel list -o execInstalledOnly and compare Configured with Runtime.
- Look for a following vib install with --force, a chmod that adds execute permission, or a file launched from /tmp.


### False positive analysis

A documented install of an unsigned vendor VIB can disable the setting for the duration of the change. The setting should be TRUE when the work is finished.

### Response and remediation

- If the change was not approved, set the control back on: esxcli system settings kernel set -s execInstalledOnly -v TRUE.
- Review VIBs installed in the same session with esxcli software vib list.
- Preserve shell.log before rotating credentials.


## Rule Query

```kuery
data_stream.dataset:vsphere.log and event.module:vsphere and message:(execInstalledOnly and ("-i 0" or "-v 0" or FALSE))
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Defense Evasion
  - Id: TA0005
  - Reference URL: [[https://attack.mitre.org/tactics/TA0005/](https://attack.mitre.org/tactics/TA0005/)](https://attack.mitre.org/tactics/TA0005/)
- Technique:
  - Name: Impair Defenses
  - Id: T1562
  - Reference URL: [[https://attack.mitre.org/techniques/T1562/](https://attack.mitre.org/techniques/T1562/)](https://attack.mitre.org/techniques/T1562/)
- Sub Technique:
  - Name: Disable or Modify Tools
  - Id: T1562.001
  - Reference URL: [[https://attack.mitre.org/techniques/T1562/001/](https://attack.mitre.org/techniques/T1562/001/)](https://attack.mitre.org/techniques/T1562/001/)