{"id":"T1675","name":"ESXi Administration Command","url":"https://attack.mitre.org/techniques/T1675","tactics":["execution"],"platforms":["ESXi"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0232","stix_id":"x-mitre-detection-strategy--c1d8aa38-aefb-4ea8-8c80-2dfa05eaaecb","name":"Detection Strategy for ESXi Administration Command","url":"https://attack.mitre.org/detectionstrategies/DET0232","analytics":[{"id":"AN0646","stix_id":"x-mitre-analytic--f25cf3cf-53b8-4fa4-be4c-d0a7a02bf739","name":"Analytic 0646","description":"Detects anomalous usage of ESXi Guest Operations APIs such as StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, or InitiateFileTransferFromGuest. Defender perspective focuses on unusual frequency of guest API calls, invocation from unexpected management accounts, or execution outside of business hours. These correlated signals indicate adversarial abuse of ESXi administrative services to run commands on guest VMs.","url":"https://attack.mitre.org/detectionstrategies/DET0232#AN0646","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"Guest Operations API invocation: StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, InitiateFileTransferFromGuest","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"ExpectedAdminUsers","description":"Whitelist of management accounts authorized to use ESXi Guest Ops APIs."},{"field":"TimeWindow","description":"Business hours during which Guest Ops API usage is expected; activity outside may be suspicious."},{"field":"OperationThreshold","description":"Number of Guest Ops API calls considered anomalous if exceeded in a given timeframe."},{"field":"AuthorizedVMs","description":"List of VMs where Guest Ops usage is permitted; usage on other VMs may indicate malicious activity."}],"live":true,"detection_strategies":["DET0232"],"techniques":["T1675"]}],"live":true,"version":"1.0","techniques":["T1675"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}