Splunk unknown stable spl

ESXi Syslog Config Change

This detection identifies changes to the syslog configuration on an ESXi host using esxcli, which may indicate an attempt to disrupt log collection and evade detection.

View Source

Detection Logic

`esxi_syslog` Message="*syslog config set*" 
AND Message="*esxcli*"
| rex field=_raw "\].*\[\s*(?P<user>[^\]]+)\]:\s(?P<command>.+)"
| rex field=_raw "Z (?<dest>[\w\.]+)\s"
| stats min(_time) as firstTime max(_time) as lastTime count by dest user command
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `esxi_syslog_config_change_filter`

False Positives

⚠ Limited false positives in most environments, however tune as needed

Field Validations

Loading…

Comments (0)

Loading comments...