Execution

T1059.012: Hypervisor CLI

Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itsel...

T1059.012 · Sub-technique ·1 platforms ·1 groups

Description

Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts.

For example, on ESXi systems, tools such as esxcli and vim-cmd allow administrators to configure firewall rules and log forwarding on the hypervisor, list virtual machines, start and stop virtual machines, and more.(Citation: Broadcom ESXCLI Reference)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: LOLESXi) Adversaries may be able to leverage these tools in order to support further actions, such as File and Directory Discovery or Data Encrypted for Impact.

Reverse Shell Cheatsheet

Read our in-depth pentesting guide related to this technique

Platforms

ESXi

Threat Groups (1)

IDGroupContext
G1048UNC3886[UNC3886](https://attack.mitre.org/groups/G1048) has used the esxcli command line utility to modify firewall rules, install malware, and for artifact ...

Associated Software (3)

IDNameTypeContext
S1096CheerscryptMalwareCheerscrypt has leveraged `esxcli` in order to terminate running virtual machines.(Citation: Trend Micro Cheerscrypt May 2022)
S1073RoyalMalwareRoyal ransomware uses `esxcli` to gather a list of running VMs and terminate them.(Citation: Trend Micro Royal Linux ESXi February 2023)
S1218VIRTUALPIEMalware[VIRTUALPIE](https://attack.mitre.org/software/S1218) is capable of command line execution on compromised ESXi servers.(Citation: Google Cloud Threat ...

Related CWE Weaknesses

References

Frequently Asked Questions

What is T1059.012 (Hypervisor CLI)?

T1059.012 is a MITRE ATT&CK technique named 'Hypervisor CLI'. It belongs to the Execution tactic(s). Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itsel...

How can T1059.012 be detected?

Detection of T1059.012 (Hypervisor CLI) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1059.012?

Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.

Which threat groups use T1059.012?

Known threat groups using T1059.012 include: UNC3886.