T1059.012 — Hypervisor CLI

Tactic: Execution · Platforms: ESXi

Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts. For example, on ESXi systems, tools such as `esxcli`…

Sub-technique of Command and Scripting Interpreter (T1059).

Sigma detection rules (1)

T1059.012 Command and Scripting Interpreter: Hypervisor CLI

title: "T1059.012 Command and Scripting Interpreter: Hypervisor CLI"
id: 7a49a0b8-387b-4704-ab33-687e1c0978ed
description: 'Detection Strategy for ESXi Hypervisor CLI Abuse. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, UserContext, CommandPattern.'
references:
  - https://attack.mitre.org/techniques/T1059/012
author: Shahrukh Khan
date: 2026-06-10
license: MIT
tags:
  - attack.execution
  - attack.t1059.012

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'esxcli'
      - 'localcli'
  selection_priv:
    CommandLine|contains:
      - 'system account'
      - 'software vib'

  condition: selection and selection_priv

falsepositives:
  - Legitimate administrative use of esxcli or localcli for account or VIB management during patching windows will also match; tuning against known admin accounts and change windows reduces noise.

level: medium

Related sub-techniques

Explore