---
title: ESXi Host Logs Deleted with rm
description: Detects a shell rm of a path under /var/log or of a *.log name. Those files hold shell commands, authentication, and hostd activity. Removing them takes...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/vsphere/defense_evasion_esxi_host_logs_deleted
products:
  - Elastic Security
---

# ESXi Host Logs Deleted with rm
Detects a shell `rm` of a path under `/var/log` or of a `*.log` name. Those files hold shell commands,
authentication, and hostd activity. Removing them takes away the record of what changed on the host.
**Rule type**: query
**Rule indices**:
- logs-vsphere.log-*

**Rule Severity**: high
**Risk Score**: 73
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://lolesxi-project.github.io/LOLESXi/#](https://lolesxi-project.github.io/LOLESXi/#)](https://lolesxi-project.github.io/LOLESXi/#)
- [[https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html](https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html)](https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html)
- [[https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21](https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21)](https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21)

**Tags**:
- Domain: Endpoint
- Data Source: VMware vSphere
- Use Case: Threat Detection
- Tactic: Defense Evasion
- Resources: Investigation Guide
- Rule Type: Custom Query (KQL)
- Platform: VMware ESXi

**Version**: 1
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: [https://www.elastic.co/docs/reference/integrations/vsphere](https://www.elastic.co/docs/reference/integrations/vsphere)

## Investigation guide


## Triage and analysis


### Investigating ESXi Host Logs Deleted with rm

shell.log records the typed command. The rule matches a line that contains rm together with a /var/log/ path or a *.log name, such as [root]: rm -f /var/log/hostd.log or [root]: rm *.log.

#### Possible investigation steps

- Read message and note the path that was deleted.
- On the host, list /var/log and see which files are missing, including shell.log, auth.log, and hostd.log.
- Review account changes, firewall changes, and VM power events from the same session that are still in the index.


### False positive analysis

Deleting one rotated log during maintenance can be expected. rm *.log removes every log name in the current directory and should be explained by a ticket.

### Response and remediation

- If the delete was not approved, isolate the host and preserve any remaining logs before they rotate.
- Rotate credentials used in that shell session.
- Confirm remote syslog still has a copy of the deleted host logs.


## Rule Query

```kuery
data_stream.dataset:vsphere.log and event.module:vsphere and message:(rm and ("*.log" or "/var/log/*"))
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Defense Evasion
  - Id: TA0005
  - Reference URL: [[https://attack.mitre.org/tactics/TA0005/](https://attack.mitre.org/tactics/TA0005/)](https://attack.mitre.org/tactics/TA0005/)
- Technique:
  - Name: Indicator Removal
  - Id: T1070
  - Reference URL: [[https://attack.mitre.org/techniques/T1070/](https://attack.mitre.org/techniques/T1070/)](https://attack.mitre.org/techniques/T1070/)
- Sub Technique:
  - Name: Clear Linux or Mac System Logs
  - Id: T1070.002
  - Reference URL: [[https://attack.mitre.org/techniques/T1070/002/](https://attack.mitre.org/techniques/T1070/002/)](https://attack.mitre.org/techniques/T1070/002/)
- Sub Technique:
  - Name: File Deletion
  - Id: T1070.004
  - Reference URL: [[https://attack.mitre.org/techniques/T1070/004/](https://attack.mitre.org/techniques/T1070/004/)](https://attack.mitre.org/techniques/T1070/004/)