{"id":"T1059.012","name":"Hypervisor CLI","url":"https://attack.mitre.org/techniques/T1059/012","tactics":["execution"],"platforms":["ESXi"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0558","stix_id":"x-mitre-detection-strategy--5307b508-28e8-44c6-9487-212ccd3ab86c","name":"Detection Strategy for ESXi Hypervisor CLI Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0558","analytics":[{"id":"AN1537","stix_id":"x-mitre-analytic--2fa4d134-8583-4cbe-bc84-bfc799205116","name":"Analytic 1537","description":"Detects suspicious use of ESXi native CLI tools like esxcli and vim-cmd by unauthorized users or outside expected maintenance windows. Focus is on actions such as stopping VMs, reconfiguring network/firewall settings, and enabling SSH or logging.","url":"https://attack.mitre.org/detectionstrategies/DET0558#AN1537","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vmkernel","channel":"esxcli, vim-cmd invocation","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-vmkernel"},{"name":"esxi:auth","channel":"SSH session/login","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"esxi-auth"}],"mutable_elements":[{"field":"TimeWindow","description":"Helps scope detection to off-hours or change control gaps."},{"field":"UserContext","description":"Environment-specific users may run these commands as part of normal ops."},{"field":"CommandPattern","description":"CLI commands vary by adversary intent (e.g., 'stop', 'reboot', 'firewall set')"}],"live":true,"detection_strategies":["DET0558"],"techniques":["T1059.012"]}],"live":true,"version":"1.0","techniques":["T1059.012"]}],"sigma_rules":[{"id":"2992ac4d-31e9-4325-99f2-b18a73221bb2","title":"ESXi VM Kill Via ESXCLI","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"vm\" and \"kill\" flag in order to kill/shutdown a specific VM.","references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html","https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/","https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.impact","attack.t1059.012","attack.t1529"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml","techniques":["T1059.012","T1529"],"cves":[]},{"id":"33e814e0-1f00-4e43-9c34-31fb7ae2b174","title":"ESXi Network Configuration Discovery Via ESXCLI","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"network\" flag in order to retrieve information about the network configuration.","references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_network.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"38eb1dbb-011f-40b1-a126-cf03a0210563","title":"ESXi Syslog Configuration Change Via ESXCLI","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects changes to the ESXi syslog configuration via \"esxcli\"","references":["https://support.solarwinds.com/SuccessCenter/s/article/Configure-ESXi-Syslog-to-LEM?language=en_US","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.defense-impairment","attack.t1685","attack.t1690","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_syslog_config_change.yml","techniques":["T1685","T1690","T1059.012"],"cves":[]},{"id":"5f1573a7-363b-4114-9208-ad7a61de46eb","title":"ESXi VM List Discovery Via ESXCLI","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"vm\" flag in order to retrieve information about the installed VMs.","references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html","https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/","https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"9691f58d-92c1-4416-8bf3-2edd753ec9cf","title":"ESXi Admin Permission Assigned To Account Via ESXCLI","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"system\" and \"permission\" flags in order to assign admin permissions to an account.","references":["https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.privilege-escalation","attack.t1059.012","attack.t1098"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_permission_change_admin.yml","techniques":["T1059.012","T1098"],"cves":[]},{"id":"b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db","title":"ESXi Account Creation Via ESXCLI","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-08-22","modified":null,"description":"Detects user account creation on ESXi system via esxcli","references":["https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.t1136","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml","techniques":["T1136","T1059.012"],"cves":[]},{"id":"d54c2f06-aca9-4e2b-81c9-5317858f4b79","title":"ESXi VSAN Information Discovery Via ESXCLI","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"vsan\" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.","references":["https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html","https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"e80273e1-9faf-40bc-bd85-dbaff104c4e9","title":"ESXi System Information Discovery Via ESXCLI","author":"Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"system\" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.","references":["https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]},{"id":"f41dada5-3f56-4232-8503-3fb7f9cf2d60","title":"ESXi Storage Information Discovery Via ESXCLI","author":"Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon","status":"test","level":"medium","date":"2023-09-04","modified":null,"description":"Detects execution of the \"esxcli\" command with the \"storage\" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.","references":["https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html","https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html","https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1033","attack.t1007","attack.t1059.012"],"path":"rules/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml","techniques":["T1033","T1007","T1059.012"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}