Detecting ESXi Administration Command Abuse (MITRE ATT&CK T1675)

ESXi Administration Command (T1675) is an Execution technique for the ESXi platform. Adversaries abuse the ESXi administration services to run commands on guest machines hosted in the virtual environment.

How attackers use it

ESXi-hosted VMs run background services that allow remote management from the ESXi server. MITRE names the VMware Tools Daemon Service, which runs as vmtoolsd.exe on Windows guests, vmware-tools-daemon on macOS guests and vmtoolsd on Linux guests.

An adversary can use the vSphere Web Services SDK to run commands and scripts through APIs such as StartProgramInGuest, ListProcessesInGuest, ListFileInGuest and InitiateFileTransferFromGuest. That can lead to follow-on behavior in the guests, including File and Directory Discovery (T1083), Data from Local System (T1005) and OS Credential Dumping (T1003).

The effect is important for defenders. Commands run through this path start inside a guest, but the operator never logged into that guest the usual way.

How to detect it

MITRE's detection strategy watches for anomalous use of the Guest Operations APIs named above. The signals are:

• Unusual frequency of guest API calls.
• Calls from management accounts that do not normally use them.
• Execution outside business hours.

Correlated, those signals point to misuse of ESXi administration services to run commands on guests.

How to reduce the risk

MITRE lists one mitigation, User Account Management. If the capability is not required, restrict the permissions of users to perform Guest Operations on ESXi-hosted VMs. Vendor documentation on virtual machine guest operations privileges describes the relevant permissions.

Then review who still holds them. Many environments grant broad administrator roles that include Guest Operations without anyone needing it.

Quick check

Sources

• MITRE ATT&CK, ESXi Administration Command (T1675): https://attack.mitre.org/techniques/T1675