attack.t1059.012

ESXi Account Creation Via ESXCLI

May 21, 2025 · attack.persistence attack.execution attack.t1136 attack.t1059.012 ·

Detects user account creation on ESXi system via esxcli

ESXi Admin Permission Assigned To Account Via ESXCLI

May 21, 2025 · attack.execution attack.privilege-escalation attack.t1059.012 attack.t1098 ·

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

ESXi Network Configuration Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·

Share on:

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

ESXi Storage Information Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·

Share on:

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

ESXi Syslog Configuration Change Via ESXCLI

May 21, 2025 · attack.defense-evasion attack.execution attack.t1562.001 attack.t1562.003 attack.t1059.012 ·

Share on:

Detects changes to the ESXi syslog configuration via "esxcli"

ESXi System Information Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·

Share on:

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

ESXi VM Kill Via ESXCLI

May 21, 2025 · attack.execution attack.impact attack.t1059.012 attack.t1529 ·

Share on:

Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

ESXi VM List Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·

Share on:

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

ESXi VSAN Information Discovery Via ESXCLI

May 21, 2025 · attack.discovery attack.execution attack.t1033 attack.t1007 attack.t1059.012 ·

Share on:

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.