ESXi Administration Command
- ID
- T1675
- Tactics
- TA0002 Execution
- Platforms
- ESXi
- Data sources
- Application Log Content
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment. Persistent background services on ESXi-hosted VMs, such as the VMware Tools Daemon Service, allow for remote management from the ESXi server. The tools daemon service runs as vmtoolsd.exe on Windows guest operating systems, vmware-tools-daemon on macOS, and vmtoolsd on Linux.[2]
Adversaries may leverage a variety of tools to execute commands on ESXi-hosted VMs – for example, by using the vSphere Web Services SDK to programmatically execute commands and scripts via APIs such as StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, and InitiateFileTransferFromGuest.[3][4] This may enable follow-on behaviors on the guest VMs, such as File and Directory Discovery, Data from Local System, or OS Credential Dumping.
Detection
- DET0232 Detection Strategy for ESXi Administration Command
Data components: Application Log Content
Mitigations (1)
- M1018 User Account Management
If not required, restrict the permissions of users to perform Guest Operations on ESXi-hosted VMs.[1]
Groups (1)
Software (2)
References
- Broadcom Virtual Machine Guest Operations Privileges
- Broadcom VMware Tools Services
- Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023
- Broadcom Running Guest OS Operations