---
title: ESXi SSH Access Enabled
description: Detects ESXi SSH being turned on. SSH is often left disabled so the host is managed through the local console, the Host Client, or vCenter. Enabling it...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/lateral_movement_esxi_ssh_enabled
products:
  - Elastic Security
---

# ESXi SSH Access Enabled
Detects ESXi SSH being turned on. SSH is often left disabled so the host is managed through the local console,
the Host Client, or vCenter. Enabling it opens a remote shell that can copy files onto the host and run commands
against the datastore.
**Rule type**: query
**Rule indices**:
- logs-vsphere.log-*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://lolesxi-project.github.io/LOLESXi/#](https://lolesxi-project.github.io/LOLESXi/#)](https://lolesxi-project.github.io/LOLESXi/#)
- [[https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html](https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html)](https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html)
- [[https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21](https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21)](https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21)

**Tags**:
- Domain: Endpoint
- Data Source: VMware vSphere
- Use Case: Threat Detection
- Tactic: Lateral Movement
- Resources: Investigation Guide
- Rule Type: Custom Query (KQL)
- Platform: VMware ESXi

**Version**: 1
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: [https://www.elastic.co/docs/reference/integrations/vsphere](https://www.elastic.co/docs/reference/integrations/vsphere)

## Investigation guide


## Triage and analysis


### Investigating ESXi SSH Access Enabled

SSH is disabled on many ESXi hosts. Turning it on is the step that lets an intruder who already has the root password open a shell and stage a payload in /tmp.

#### Possible investigation steps

- Confirm whether the hit is the hostd sentence SSH access has been enabled or the shell command hostsvc/enable_ssh.
- Review source.ip and the account on nearby authentication events.
- Check for a following cd /tmp, file upload, or vm process command.
- Ask whether a change ticket opened SSH on this host.


### False positive analysis

Documented troubleshooting enables SSH and should disable it afterward. An enable with no ticket, followed by datastore commands, is the intrusion pattern.

### Response and remediation

- If the enable was not approved, disable SSH (vim-cmd hostsvc/disable_ssh) after preserving logs.
- Rotate the root password and review accounts added in the same window.
- Hunt other hosts for the same hostd event.


## Rule Query

```kuery
data_stream.dataset:vsphere.log and message:("SSH access has been enabled" or "hostsvc/enable_ssh")
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Lateral Movement
  - Id: TA0008
  - Reference URL: [[https://attack.mitre.org/tactics/TA0008/](https://attack.mitre.org/tactics/TA0008/)](https://attack.mitre.org/tactics/TA0008/)
- Technique:
  - Name: Remote Services
  - Id: T1021
  - Reference URL: [[https://attack.mitre.org/techniques/T1021/](https://attack.mitre.org/techniques/T1021/)](https://attack.mitre.org/techniques/T1021/)
- Sub Technique:
  - Name: SSH
  - Id: T1021.004
  - Reference URL: [[https://attack.mitre.org/techniques/T1021/004/](https://attack.mitre.org/techniques/T1021/004/)](https://attack.mitre.org/techniques/T1021/004/)