ESXi Admin Permission Assigned To Account Via ESXCLI

Title: ESXi Admin Permission Assigned To Account Via ESXCLI
Status: test
Description:Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.
References:
  -https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-04
modified:None
Tags:

• -'attack.persistence'
• -'attack.execution'
• -'attack.privilege-escalation'
• -'attack.t1059.012'
• -'attack.t1098'

Logsource:

• category: process_creation
• product: linux

Detection:
  selection:
    Image|endswith: '/esxcli'
    CommandLine|contains: 'system'
    CommandLine|contains|all:
      -' permission '
      -' set'
      -'Admin'

  condition:selection
Falsepositives:
  -Legitimate administration activities
Level: high