Edit Threat

Name

Category

Tags (comma-separated)

Description Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment. Persistent background services on ESXi-hosted VMs, such as the VMware Tools Daemon Service, allow for remote management from the ESXi server. The tools daemon service runs as vmtoolsd.exe on Windows guest operating systems, vmware-tools-daemon on macOS, and vmtoolsd on Linux. Adversaries may leverage a variety of tools to execute commands on ESXi-hosted VMs – for ex