Detect ESXi discovery activity by monitoring ESXCLI commands that enumerate hosts, datastores, virtual machines, networks, and storage configuration. Treat broad inventory queries from unexpected administrative sessions as suspicious, especially before account changes or ransomware activity. Correlate command history, login source, and timing with other reconnaissance on the same host or management network.
What ESXCLI discovery looks like in practice
ESXCLI is often used by administrators to query ESXi state, but discovery activity becomes interesting when it shifts from routine administration to broad enumeration. Commands that list hosts, datastores, virtual machines, networks, adapters, and storage settings can reveal how much an operator already knows about the environment. The key question is whether the command pattern fits normal operational work or looks like reconnaissance across the host management plane.
Discovery usually appears as a burst of read-only commands from a single session, often with multiple inventory sweeps in a short period. That pattern matters because attackers commonly need to map the virtualisation layer before they can disable services, identify valuable systems, or prepare destructive actions. If the same session is probing inventory and configuration data that an operator would normally touch only during maintenance, treat it as telemetry worth investigating.
In detection engineering terms, the signal is not one command name alone. The stronger indicator is the combination of command intent, breadth, source, and timing. A narrow check during a planned change window is less suspicious than repeated inventory queries from an unusual administrative endpoint, especially when the account has not recently been used for routine ESXi administration. Linux detection and response guidance is still useful here because the same investigative discipline applies, namely correlate shell activity, authentication context, and host telemetry instead of relying on a single event.
How to separate normal administration from reconnaissance
Start by grouping ESXCLI commands by function: host inventory, datastore inventory, virtual machine enumeration, network enumeration, and storage configuration queries. A legitimate admin session usually has a task-driven sequence, such as checking one cluster, one datastore, or one network object in support of a change. Reconnaissance tends to be broader and less selective, with command output used to build a map of the environment rather than complete a specific maintenance task.
Also compare the session against the account's normal behavior. An account that usually manages a small set of hosts but suddenly issues wide inventory queries across the management plane deserves attention, even if each command is individually valid. The same is true when ESXCLI use appears immediately before account changes, privilege modifications, backup tampering, or other actions that suggest pre-positioning for later abuse. Top 10 NHI Issues is relevant as a governance lens because broad discovery often accompanies weak ownership, excessive access, or stale administrative pathways.
Time correlation is critical. Discovery that follows a new login source, an out-of-hours session, or a management network hop from an unfamiliar workstation is more suspicious than the same commands during a scheduled change. If you also see nearby activity on SSH, vCenter, backup consoles, or storage administration tools, treat the ESXCLI commands as part of a larger operator workflow rather than an isolated event. That broader view helps distinguish maintenance from an adversary building a target map.
What to collect and validate before you call it malicious
Preserve the ESXi shell or audit records that show the command string, timestamp, session identity, and source of access. Then validate whether the activity aligns with an approved change, a documented maintenance window, or a known administrator workflow. If the environment supports it, retain surrounding management-plane logs so you can reconstruct sequence, not just isolated commands. Key challenges and risks in identity and access governance often show up first as visibility gaps, which is exactly why reconstruction matters here.
Once the session is suspicious, look beyond discovery and ask what it was preparing for. ESXCLI enumeration can be a precursor to service disruption, mass configuration change, datastore manipulation, or ransomware staging. On ESXi, broad inventory visibility can shorten the time needed to identify where to strike next, so the investigation should extend to nearby administrative actions, authentication anomalies, and signs of host hardening being reversed. MGM Resorts breach 2023 is a useful reminder that ransomware campaigns often begin with identity-driven access and then move quickly into host and virtualization discovery.
Risk and Threat Considerations
Broad ESXCLI discovery is risky because it gives an operator, legitimate or not, a fast map of the virtual estate and the management surface. In a virtualised environment, that map can reveal which hosts, datastores, and networks are worth targeting next, and it can reduce the effort required to disrupt availability or prepare ransomware execution.
Failure mechanism: An attacker or unauthorized operator uses valid management access to enumerate ESXi resources, then combines the results with credentialed access, configuration changes, or destructive follow-on actions.
Impact: The result can be faster lateral planning, more effective targeting of high-value virtual assets, and earlier warning that the management plane is being used for pre-attack reconnaissance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0007 — Discovery | ESXCLI enumeration is host and virtualisation discovery activity. |
| Recommendation — Map ESXCLI sweeps to Discovery and alert on unusual inventory enumeration. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Command history and session correlation are needed to spot suspicious ESXi enumeration. |
| AC-6 — Least Privilege | Broad ESXCLI access can expose too much management capability to a compromised admin path. | |
| Recommendation — Review admin command logs and correlate them with source and timing. Restrict ESXi administration to the minimum set of accounts and hosts required. | ||
| CIS Controls v8 | CIS-5 — Account Management | Unexpected ESXCLI discovery often follows account misuse or excessive admin access. |
| Recommendation — Audit administrative accounts that can issue ESXCLI commands and remove unnecessary access. | ||
Practitioner Guidance
What to prioritise: Treat ESXCLI discovery as suspicious when it is broad, repeated, or disconnected from a change record. The highest-value triage is not the command output itself, but whether the session came from a normal admin source and whether the same account is also touching other management systems.
What to verify: Confirm the session origin, the account's expected duties, and whether the enumeration matches a planned task. If you cannot tie the activity to an approved operational reason, investigate it alongside authentication events, nearby privilege changes, and any host-level sign of tampering.
Practitioner takeaway: The most reliable distinction is between task-specific administration and environment-wide mapping. If ESXCLI is being used to sweep inventory across the management plane, assume the session is building situational awareness for something larger until the surrounding context proves otherwise.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org