---
title: ESXi Root Password Accepted from Remote Host
description: Detects hostd accepting the ESXi root password from a remote address. A successful remote root login opens the Host Client or the API with full control...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/initial_access_esxi_root_password_accepted
products:
  - Elastic Security
---

# ESXi Root Password Accepted from Remote Host
Detects hostd accepting the ESXi root password from a remote address. A successful remote root login opens the
Host Client or the API with full control of the host. Local sessions from 127.0.0.1 are left out of the rule.
**Rule type**: query
**Rule indices**:
- logs-vsphere.log-*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://lolesxi-project.github.io/LOLESXi/#](https://lolesxi-project.github.io/LOLESXi/#)](https://lolesxi-project.github.io/LOLESXi/#)
- [[https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html](https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html)](https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html)
- [[https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21](https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21)](https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21)

**Tags**:
- Domain: Endpoint
- Data Source: VMware vSphere
- Use Case: Threat Detection
- Tactic: Initial Access
- Resources: Investigation Guide
- Rule Type: Custom Query (KQL)
- Platform: VMware ESXi
- Threat: Ransomware

**Version**: 1
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: [https://www.elastic.co/docs/reference/integrations/vsphere](https://www.elastic.co/docs/reference/integrations/vsphere)

## Investigation guide


## Triage and analysis


### Investigating ESXi Root Password Accepted from Remote Host

Vimsvc.HaSessionManager writes this line when a root password is accepted. The source after from is the client address. A remote address is a direct HTTPS login to the host. from 127.0.0.1 is local esxcli and is not part of this rule. vpxuser from 127.0.0.1 is the host's own client.

#### Possible investigation steps

- Read the source address in message. Compare it with known admin workstations.
- In the same sid and opID, look for the following User root@<ip> logged in event and for SSH access has been enabled.
- Check later shell commands for chmod, /tmp, and /vmfs/volumes.


### False positive analysis

A documented Host Client login as root from the admin network can be benign. A root acceptance from an unexpected address, followed by SSH being enabled, is the lateral-movement pattern.

### Response and remediation

- If the source was not approved, disable the session, rotate the root password, and review accounts created in that window.
- Preserve hostd.log for the sid on the event.
- Hunt other hosts for Accepted password for user root from the same source address.


## Rule Query

```kuery
data_stream.dataset:vsphere.log and event.module:vsphere and message:("Accepted password for user root" and not "from 127.0.0.1")
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Initial Access
  - Id: TA0001
  - Reference URL: [[https://attack.mitre.org/tactics/TA0001/](https://attack.mitre.org/tactics/TA0001/)](https://attack.mitre.org/tactics/TA0001/)
- Technique:
  - Name: Valid Accounts
  - Id: T1078
  - Reference URL: [[https://attack.mitre.org/techniques/T1078/](https://attack.mitre.org/techniques/T1078/)](https://attack.mitre.org/techniques/T1078/)
- Sub Technique:
  - Name: Default Accounts
  - Id: T1078.001
  - Reference URL: [[https://attack.mitre.org/techniques/T1078/001/](https://attack.mitre.org/techniques/T1078/001/)](https://attack.mitre.org/techniques/T1078/001/)