ESXi Administration Command

Technique · ATTACK:enterprise:T1675

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1675",
  "title": "ESXi Administration Command",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1675",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--31e5011f-090e-45be-9bb6-17a1c5e8219b",
  "external_id": "T1675",
  "domain": "enterprise",
  "created": "2025-03-28T14:01:52.810Z",
  "modified": "2025-04-16T14:57:47.078Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"
    },
    {
      "source_name": "Broadcom Running Guest OS Operations",
      "url": "https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere-sdks-tools/8-0/web-services-sdk-programming-guide/virtual-machine-guest-operations/running-guest-os-operations.html"
    },
    {
      "source_name": "Broadcom VMware Tools Services",
      "url": "https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/tools/12-4-0/vmware-tools-administration-12-4-0/introduction-to-vmware-tools/vmware-tools-service.html"
    }
  ]
}

Explicit source assertions (4)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1217 → uses → ATTACK:enterprise:T1675

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f60db6a-3985-41dd-bcdf-1ae243383972

Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1675

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47736f23-469c-40a6-b287-8a6a39eca799

Google Cloud Mandiant UNC3886 2024 · Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Google Cloud Threat Intelligence ESXi VIBs 2022 · Mandiant Fortinet Zero Day

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1675

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89583dab-3d70-43d9-811a-e14b1d379f4a

CheckPointResearch_TheGentlemen_April2026

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1675

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c85cc49-731e-44ae-b8a0-2162444e9ee7

Broadcom Virtual Machine Guest Operations Privileges

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.