Techniques › T1675 › AN0646
AN0646 Analytic 0646
ESXi · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects anomalous usage of ESXi Guest Operations APIs such as StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, or InitiateFileTransferFromGuest. Defender perspective focuses on unusual frequency of guest API calls, invocation from unexpected management accounts, or execution outside of business hours. These correlated signals indicate adversarial abuse of ESXi administrative services to run commands on guest VMs.</p>
- Detects
- T1675 ESXi Administration Command
- Part of
- DET0232 Detection Strategy for ESXi Administration Command
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| esxi:hostd | Guest Operations API invocation: StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, InitiateFileTransferFromGuest | DC0038 Application Log Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ExpectedAdminUsers | Whitelist of management accounts authorized to use ESXi Guest Ops APIs. |
TimeWindow | Business hours during which Guest Ops API usage is expected; activity outside may be suspicious. |
OperationThreshold | Number of Guest Ops API calls considered anomalous if exceeded in a given timeframe. |
AuthorizedVMs | List of VMs where Guest Ops usage is permitted; usage on other VMs may indicate malicious activity. |