cyberstrikeus T1675 ESXi Administration Command
High-Level Description
Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment. Persistent background services on ESXi-hosted VMs, such as the VMware Tools Daemon Service, allow for remote management from the ESXi server. The tools daemon service runs as vmtoolsd.exe on Windows guest operating systems, vmware-tools-daemon on macOS, and vmtoolsd on Linux.
Adversaries may leverage a variety of tools to execute commands on ESXi-hosted VMs – for example, by using the vSphere Web Services SDK to programmatically execute commands and scripts via APIs such as StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, and InitiateFileTransferFromGuest. This may enable follow-on behaviors on the guest VMs, such as File and Directory Discovery, Data from Local System, or OS Credential Dumping.
Kill Chain Phase
- Execution (TA0002)
Platforms: ESXi
What to Check
- Identify if ESXi Administration Command technique is applicable to target environment
- Check ESXi systems for indicators of ESXi Administration Command
- Verify mitigations are bypassed or absent (1 known mitigations)
- Assess detection coverage (1 detection strategies)
How to Test
Manual Testing
Identify Attack Surface: Determine if the target environment is susceptible to ESXi Administration Command by examining the target platforms (ESXi).
Assess Existing Defenses: Review whether mitigations for T1675 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
Remediation Guide
M1018 User Account Management
If not required, restrict the permissions of users to perform Guest Operations on ESXi-hosted VMs.
Detection
Detection Strategy for ESXi Administration Command
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| ESXi Administration Command technique applicable | High | Execution |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-94 | Improper Control of Generation of Code |