tfMITRE ATT&CK technique

ESXi Administration Command T1675

Tactic: Execution
Platform: ESXi
Version: 1.0
Created: 28 March 2025
Last modified: 16 April 2025

Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment. Persistent background services on ESXi-hosted VMs, such as the VMware Tools Daemon Service, allow for remote management from the ESXi server. The tools daemon service runs as vmtoolsd.exe on Windows guest operating systems, vmware-tools-daemon on macOS, and vmtoolsd on Linux.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 32% of ATT&CK techniques have none either.

Offense vs defense T1675

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Application Log ContentDC0038	esxi:hostd	Guest Operations API invocation: StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, InitiateFileTransferFromGuest

Data component

Name

Channel

Application Log ContentDC0038

esxi:hostd

Guest Operations API invocation: StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, InitiateFileTransferFromGuest

Field	What you tune
ExpectedAdminUsers	Whitelist of management accounts authorized to use ESXi Guest Ops APIs.
TimeWindow	Business hours during which Guest Ops API usage is expected; activity outside may be suspicious.
OperationThreshold	Number of Guest Ops API calls considered anomalous if exceeded in a given timeframe.
AuthorizedVMs	List of VMs where Guest Ops usage is permitted; usage on other VMs may indicate malicious activity.

Field

What you tune

ExpectedAdminUsers

Whitelist of management accounts authorized to use ESXi Guest Ops APIs.

TimeWindow

Business hours during which Guest Ops API usage is expected; activity outside may be suspicious.

OperationThreshold

Number of Guest Ops API calls considered anomalous if exceeded in a given timeframe.

AuthorizedVMs

List of VMs where Guest Ops usage is permitted; usage on other VMs may indicate malicious activity.

Offense vs defense T1675

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Application Log ContentDC0038	esxi:hostd	Guest Operations API invocation: StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, InitiateFileTransferFromGuest

Data component

Name

Channel

Application Log ContentDC0038

esxi:hostd

Guest Operations API invocation: StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, InitiateFileTransferFromGuest

Field	What you tune
ExpectedAdminUsers	Whitelist of management accounts authorized to use ESXi Guest Ops APIs.
TimeWindow	Business hours during which Guest Ops API usage is expected; activity outside may be suspicious.
OperationThreshold	Number of Guest Ops API calls considered anomalous if exceeded in a given timeframe.
AuthorizedVMs	List of VMs where Guest Ops usage is permitted; usage on other VMs may indicate malicious activity.

Field

What you tune

ExpectedAdminUsers

Whitelist of management accounts authorized to use ESXi Guest Ops APIs.

TimeWindow

Business hours during which Guest Ops API usage is expected; activity outside may be suspicious.

OperationThreshold

Number of Guest Ops API calls considered anomalous if exceeded in a given timeframe.

AuthorizedVMs

List of VMs where Guest Ops usage is permitted; usage on other VMs may indicate malicious activity.

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
No rules found. Try adjusting your filters.

Title

Description

ESXi Administration Command T1675

ESXi Administration Command T1675

ESXi Administration Command MITRE reference T1675

Offense vs defense T1675

ESXi Administration Command detection strategy DET0232

Detection Strategy for ESXi Administration Command

Log sources

Tunable fields

ESXi Administration Command MITRE reference T1675

Offense vs defense T1675

ESXi Administration Command detection strategy DET0232

Detection Strategy for ESXi Administration Command

Log sources

Tunable fields

ESXi Administration Command detections T1675

ESXi Administration Command detections T1675