{
  "technique_id": "T1675",
  "name": "ESXi Administration Command",
  "tactics": [
    "Execution"
  ],
  "platforms": [
    "ESXi"
  ],
  "summary": "Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment. Persistent background services on ESXi-hosted VMs, such as the VMware Tools Daemon Service, allow for remote management from the ESXi server. The tools daemon service runs as `vmtoolsd.exe` on Windows guest operating systems, `vmware-tools-daemon` on macOS, and `vmtoolsd ` on Linux...",
  "generated_by": "SOC Response Atlas by Basyrix"
}