T1059.012Execution
Hypervisor CLI
Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts. For example, on ESXi systems, tools such as `esxcli` and `vim-cmd` allow administrators to configure firewall rules and log forwarding on the hypervisor…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
9 Sigma rules tagged T1059.012Hypervisor CLIT1059.0129 general rules
- ESXi Admin Permission Assigned To Account Via ESXCLIhightest
- ESXi Account Creation Via ESXCLImediumtest
- ESXi Network Configuration Discovery Via ESXCLImediumtest
- ESXi Storage Information Discovery Via ESXCLImediumtest
- ESXi Syslog Configuration Change Via ESXCLImediumtest
- ESXi System Information Discovery Via ESXCLImediumtest
- ESXi VM Kill Via ESXCLImediumtest
- ESXi VM List Discovery Via ESXCLImediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Hypervisor CLI
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.