Techniques › T1491.001 › AN0232
AN0232 Analytic 0232
ESXi · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Adversary modifies ESXi host login banner or MOTD file (/etc/motd), either through SSH or host console access. May involve configuration file overwrite or API calls from compromised vSphere clients.</p>
- Detects
- T1491.001 Internal Defacement
- Part of
- DET0082 Internal Website and System Content Defacement via UI or Messaging Modifications
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| ESXiLogs:messages | changes to /etc/motd or /etc/vmware/welcome | DC0061 File Modification |
| esxi:hostd | modification of config files or shell command execution | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
LoginBannerFilePath | Target file paths (e.g., /etc/motd) may be changed via symbolic link or override |
AccessOrigin | ESXi hostd vs. SSH-based defacement origin may affect visibility |