UNC3886G1048 ↗
Has used the esxcli command line utility to modify firewall rules, install malware, and for artifact removal.12
tfMITRE ATT&CK sub-technique
Hypervisor CLI T1059.012
sub-technique of T1059 Command and Scripting Interpreter
- Tactic
- Execution
- Platform
- ESXi
- Version
- 1.0
- Created
- 26 March 2025
- Last modified
- 15 April 2025
- Contributors
- Liran Ravich, CardinalOps; Janantha Marasinghe
Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.9
Detection rules73rd pct
Detection rules73rd percentile · 73% of ATT&CK techniques have this many detection rules written or fewer.Hypervisor CLI MITRE reference T1059.012
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
VIRTUALPIES1218 ↗
Is capable of command line execution on compromised ESXi servers.1
CheerscryptS1096 ↗
Has leveraged esxcli in order to terminate running virtual machines.1
RoyalS1073 ↗
Ransomware uses esxcli to gather a list of running VMs and terminate them.1
All 3 software entries for this technique
Offense vs defense T1059.012
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 0
first rule: 2023 Q3Hypervisor CLI detection strategy DET0558
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for ESXi Hypervisor CLI Abuse
1 platform
AN1537 · ESXi
Detects suspicious use of ESXi native CLI tools like esxcli and vim-cmd by unauthorized users or outside expected maintenance windows. Focus is on actions such as stopping VMs, reconfiguring network/firewall settings, and enabling SSH or logging.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | esxi:auth | SSH session/login |
| Command ExecutionDC0064 | esxi:vmkernel | esxcli, vim-cmd invocation |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Helps scope detection to off-hours or change control gaps. |
| UserContext | Environment-specific users may run these commands as part of normal ops. |
| CommandPattern | CLI commands vary by adversary intent (e.g., 'stop', 'reboot', 'firewall set') |