1. Home
  2. Matrices
  3. Enterprise
  4. ESXi

ESXi Matrix

Below are the tactics and techniques representing the MITRE ATT&CK® ESXi platform. The techniques below are known to target VMware ESXi hypervisors. The Matrix contains information for the ESXi platform. The Matrix contains information for the ESXi platform.

View on the ATT&CK® Navigator
Version Permalink
Initial Access Execution Persistence Privilege Escalation Stealth Defense Impairment Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
2 techniques 3 techniques 7 techniques 5 techniques 7 techniques 4 techniques 1 techniques 12 techniques 3 techniques 2 techniques 14 techniques 4 techniques 7 techniques
Exploit Public-Facing Application
Valid Accounts (3)
=
Command and Scripting Interpreter (3)
=
ESXi Administration Command
Scheduled Task/Job (1)
=
Account Manipulation (1)
=
Boot or Logon Initialization Scripts (1)
=
Compromise Host Software Binary
Create Account (1)
=
Scheduled Task/Job (1)
=
Server Software Component (1)
=
Valid Accounts (3)
=
Account Manipulation (1)
=
Boot or Logon Initialization Scripts (1)
=
Escape to Host
Scheduled Task/Job (1)
=
Valid Accounts (3)
=
Deobfuscate/Decode Files or Information
Execution Guardrails
Hide Artifacts (1)
=
Indicator Removal (4)
=
Masquerading (1)
=
Obfuscated Files or Information
Valid Accounts (3)
=
Disable or Modify System Firewall
Disable or Modify Tools
File and Directory Permissions Modification
Prevent Command History Logging
Brute Force (3)
=
Account Discovery (1)
=
File and Directory Discovery
Local Storage Discovery
Log Enumeration
Process Discovery
Remote System Discovery
Software Discovery
System Information Discovery
System Network Configuration Discovery (1)
=
System Network Connections Discovery
System Time Discovery
Virtual Machine Discovery
Exploitation of Remote Services
Lateral Tool Transfer
Remote Services (1)
=
Data from Local System
Data Staged (2)
=
Application Layer Protocol (3)
=
Data Encoding (2)
=
Data Obfuscation (3)
=
Dynamic Resolution (3)
=
Encrypted Channel (2)
=
Fallback Channels
Hide Infrastructure
Ingress Tool Transfer
Multi-Stage Channels
Non-Application Layer Protocol
Non-Standard Port
Protocol Tunneling
Proxy (4)
=
Web Service (3)
=
Data Transfer Size Limits
Exfiltration Over Alternative Protocol (3)
=
Exfiltration Over C2 Channel
Exfiltration Over Web Service (4)
=
Account Access Removal
Data Destruction
Data Encrypted for Impact
Defacement (1)
=
Inhibit System Recovery
Service Stop
System Shutdown/Reboot
Initial Access Execution Persistence Privilege Escalation Stealth Defense Impairment Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
2 techniques 3 techniques 7 techniques 5 techniques 7 techniques 4 techniques 1 techniques 12 techniques 3 techniques 2 techniques 14 techniques 4 techniques 7 techniques
Exploit Public-Facing Application
=
Valid Accounts (3)
=
Command and Scripting Interpreter (3)
ESXi Administration Command
=
Scheduled Task/Job (1)
=
Account Manipulation (1)
=
Boot or Logon Initialization Scripts (1)
Compromise Host Software Binary
=
Create Account (1)
=
Scheduled Task/Job (1)
=
Server Software Component (1)
=
Valid Accounts (3)
=
Account Manipulation (1)
=
Boot or Logon Initialization Scripts (1)
Escape to Host
=
Scheduled Task/Job (1)
=
Valid Accounts (3)
Deobfuscate/Decode Files or Information
Execution Guardrails
=
Hide Artifacts (1)
=
Indicator Removal (4)
=
Masquerading (1)
Obfuscated Files or Information
=
Valid Accounts (3)
Disable or Modify System Firewall
Disable or Modify Tools
File and Directory Permissions Modification
Prevent Command History Logging
=
Brute Force (3)
=
Account Discovery (1)
File and Directory Discovery
Local Storage Discovery
Log Enumeration
Process Discovery
Remote System Discovery
Software Discovery
System Information Discovery
=
System Network Configuration Discovery (1)
System Network Connections Discovery
System Time Discovery
Virtual Machine Discovery
Exploitation of Remote Services
Lateral Tool Transfer
=
Remote Services (1)
Data from Local System
=
Data Staged (2)
=
Application Layer Protocol (3)
=
Data Encoding (2)
=
Data Obfuscation (3)
=
Dynamic Resolution (3)
=
Encrypted Channel (2)
Fallback Channels
Hide Infrastructure
Ingress Tool Transfer
Multi-Stage Channels
Non-Application Layer Protocol
Non-Standard Port
Protocol Tunneling
=
Proxy (4)
=
Web Service (3)
Data Transfer Size Limits
=
Exfiltration Over Alternative Protocol (3)
Exfiltration Over C2 Channel
=
Exfiltration Over Web Service (4)
Account Access Removal
Data Destruction
Data Encrypted for Impact
=
Defacement (1)
Inhibit System Recovery
Service Stop
System Shutdown/Reboot