---
title: ESXi Syslog Remote Host Reset
description: Detects the ESXi remote syslog destination being cleared with --reset=loghost. The loghost is where host logs are forwarded for retention and detection...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_syslog_loghost_reset
products:
  - Elastic Security
---

# ESXi Syslog Remote Host Reset
Detects the ESXi remote syslog destination being cleared with `--reset=loghost`. The loghost is where host logs
are forwarded for retention and detection. Clearing it keeps later commands on the host only, so an external
collector stops receiving them.
**Rule type**: query
**Rule indices**:
- logs-vsphere.log-*

**Rule Severity**: high
**Risk Score**: 73
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://lolesxi-project.github.io/LOLESXi/#](https://lolesxi-project.github.io/LOLESXi/#)](https://lolesxi-project.github.io/LOLESXi/#)
- [[https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html](https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html)](https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html)
- [[https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21](https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21)](https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21)

**Tags**:
- Domain: Endpoint
- Data Source: VMware vSphere
- Use Case: Threat Detection
- Tactic: Defense Evasion
- Resources: Investigation Guide
- Rule Type: Custom Query (KQL)
- Platform: VMware ESXi

**Version**: 1
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: [https://www.elastic.co/docs/reference/integrations/vsphere](https://www.elastic.co/docs/reference/integrations/vsphere)

## Investigation guide


## Triage and analysis


### Investigating ESXi Syslog Remote Host Reset

Remote syslog is often the only copy of ESXi shell history that leaves the host. --reset=loghost drops that destination. Obfuscated commands in the same reports decode to this exact esxcli line.

#### Possible investigation steps

- Read message for a literal esxcli line or an obfuscated line that still contains reset=loghost.
- Run or review esxcli system syslog config get and confirm whether Remote Host is empty.
- Correlate with firewall, SSH, and VM shutdown commands from the same session.


### False positive analysis

Collector migrations reset the old loghost and then set a new one. An empty loghost that stays empty is not a migration.

### Response and remediation

- Restore the collector: esxcli system syslog config set --loghost=<collector> and reload syslog.
- Pull local shell.log, hostd.log, and auth.log before they rotate. The gap while loghost was empty will be missing from the collector.
- If the reset was unauthorized, isolate the host.


## Rule Query

```kuery
data_stream.dataset:vsphere.log and message:("syslog config set" and ("--reset loghost" or "--reset=loghost" or "reset=loghost"))
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Defense Evasion
  - Id: TA0005
  - Reference URL: [[https://attack.mitre.org/tactics/TA0005/](https://attack.mitre.org/tactics/TA0005/)](https://attack.mitre.org/tactics/TA0005/)
- Technique:
  - Name: Impair Defenses
  - Id: T1562
  - Reference URL: [[https://attack.mitre.org/techniques/T1562/](https://attack.mitre.org/techniques/T1562/)](https://attack.mitre.org/techniques/T1562/)
- Sub Technique:
  - Name: Disable or Modify Tools
  - Id: T1562.001
  - Reference URL: [[https://attack.mitre.org/techniques/T1562/001/](https://attack.mitre.org/techniques/T1562/001/)](https://attack.mitre.org/techniques/T1562/001/)