Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts.
For example, on ESXi systems, tools such as esxcli and vim-cmd allow administrators to configure firewall rules and log forwarding on the hypervisor, list virtual machines, start and stop virtual machines, and more.[1][2][3] Adversaries may be able to leverage these tools in order to support further actions, such as File and Directory Discovery or Data Encrypted for Impact.
| ID | Name | Description |
|---|---|---|
| S1096 | Cheerscrypt |
Cheerscrypt has leveraged |
| S1073 | Royal |
Royal ransomware uses |
| G1048 | UNC3886 |
UNC3886 has used the esxcli command line utility to modify firewall rules, install malware, and for artifact removal.[6][7] |
| S1218 | VIRTUALPIE |
VIRTUALPIE is capable of command line execution on compromised ESXi servers.[6] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0558 | Detection Strategy for ESXi Hypervisor CLI Abuse | AN1537 |
Detects suspicious use of ESXi native CLI tools like esxcli and vim-cmd by unauthorized users or outside expected maintenance windows. Focus is on actions such as stopping VMs, reconfiguring network/firewall settings, and enabling SSH or logging. |