Techniques › T1222 › AN0837
AN0837 Analytic 0837
ESXi · attack.mitre.org · ATT&CK Enterprise v19.2
<p>ESXi hypervisor permission modification behavioral chain: (1) SSH access to ESXi host, (2) chmod/chown execution on VMFS datastore files or system configuration, (3) Modification of VM configuration files (.vmx) or virtual disk permissions, (4) Hostd service log correlation, (5) vCenter permission change events if centrally managed</p>
- Detects
- T1222 File and Directory Permissions Modification
- Part of
- DET0299 Multi-Platform File and Directory Permissions Modification Detection Strategy
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| esxi:shell | shell command execution for chmod, chown, or file permission modification on VMFS or system files | DC0064 Command Execution |
| esxi:hostd | host daemon events related to file or VM permission changes | DC0059 File Metadata |
| esxi:vpxd | permission change operations on datastores or VMs | DC0066 Active Directory Object Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AuthorizedSSHUsers | ESXi user accounts authorized for shell access and file system operations |
CriticalVMFSPaths | VMFS datastore paths requiring permission change monitoring |
ShellAccessTimeWindow | Time correlation window for linking SSH access with permission modifications |
vCenterIntegrationScope | Scope of vCenter audit event correlation with ESXi host activities |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2022-22960 | VMware Multiple Products | Mapped |