Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1675_esxi-administration-command
Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment.
Passed 21 of 22 test cases with the skill, and 14 of 22 without it.
and 6 more in the full report
7 fixed14 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
In our application security tracking system, we need to map the ESXi Administration Command technique to its underlying Common Weakness Enumeration entry. Is it categorized under CWE-269 (Improper Privilege Management) or CWE-94? Specify the title and ID.
| Checked | Without skill | With skill |
|---|---|---|
| identifies CWE-94 as the weakness classification | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment. Persistent background services on ESXi-hosted VMs, such as the VMware Tools Daemon Service, allow for remote management from the ESXi server. The tools daemon service runs as vmtoolsd.exe on Windows guest operating systems, vmware-tools-daemon on macOS, and vmtoolsd on Linux.
Adversaries may leverage a variety of tools to execute commands on ESXi-hosted VMs – for example, by using the vSphere Web Services SDK to programmatically execute commands and scripts via APIs such as StartProgramInGuest, ListProcessesInGuest, ListFileInGuest, and InitiateFileTransferFromGuest. This may enable follow-on behaviors on the guest VMs, such as File and Directory Discovery, Data from Local System, or OS Credential Dumping.
Platforms: ESXi
Identify Attack Surface: Determine if the target environment is susceptible to ESXi Administration Command by examining the target platforms (ESXi).
Assess Existing Defenses: Review whether mitigations for T1675 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
If not required, restrict the permissions of users to perform Guest Operations on ESXi-hosted VMs.
test cases passed, vs 14 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.