T1675 — ESXi Administration Command

Tactic: Execution · Platforms: ESXi

Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment. Persistent background services on ESXi-hosted VMs, such as the VMware Tools Daemon Service, allow for remote management from the ESXi server. The tools daemon service…

Sigma detection rules (1)

T1675 ESXi Administration Command

title: T1675 ESXi Administration Command
id: 79265310-a300-4727-8ee6-bae2ea57435c
description: 'Detection Strategy for ESXi Administration Command. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExpectedAdminUsers, TimeWindow, OperationThreshold, AuthorizedVMs.'
references:
  - https://attack.mitre.org/techniques/T1675
author: Shahrukh Khan
date: 2026-04-16
license: MIT
tags:
  - attack.execution
  - attack.t1675

logsource:
  product: esxi

detection:
  selection:
    Message|contains:
      - 'esxcli '
      - 'vim-cmd '
      - 'localcli '

  condition: selection

falsepositives:
  - This is intentionally broad since essentially all ESXi administration flows through esxcli, vim-cmd, or localcli; it is only useful once tuned to ExpectedAdminUsers, TimeWindow, OperationThreshold, and AuthorizedVMs, and should not be actioned on its own.

level: informational

Explore