Hypervisor CLI abuse (MITRE ATT&CK T1059.012) is an Execution technique that applies to ESXi.
Hypervisor command line interpreters let administrators manage both the hypervisor and the guest virtual machines it hosts. On ESXi, tools such as esxcli and vim-cmd can configure firewall rules and log forwarding, list virtual machines, and start and stop them.
How attackers use it
MITRE says adversaries who can reach these tools can use them to support further actions. Two are named: File and Directory Discovery (T1083) and Data Encrypted for Impact (T1486). One shell on the hypervisor reaches every guest on it, which is why this surface matters.
How to detect it
MITRE's detection strategy targets suspicious use of esxcli and vim-cmd by unauthorized users, or outside expected maintenance windows. The actions to watch are stopping VMs, reconfiguring network or firewall settings, and enabling SSH or changing logging.
Forward ESXi shell and authentication logs to a central system so that records survive on the host being attacked, and compare activity with your maintenance calendar.
How to reduce the risk
MITRE notes that this technique cannot be easily mitigated with preventive controls, since it abuses system features. Defense leans on detection and on keeping access narrow. Practical steps:
- Limit who can log in to the ESXi shell and from where.
- Keep SSH disabled when it is not needed, and alert when it is turned on.
- Centralize logs, including the shell command log, off the host.
For related shell controls on ESXi, see the Unix Shell post in this series, which covers the execInstalledOnly setting.
Quick check
Which ESXi tools does MITRE name for this technique?
esxcli and vim-cmd.
