PW-039HygieneTrusts, management planes and other systems

Tier Zero computers are virtual machines of an unmodeled hypervisor

Tier Zero computers are VMware virtual machines, so whoever administers their ESXi hosts or vCenter controls them, and Pathwarden can't see who that is.

Category: Hygiene
Severity: Medium.
Typical owner: Virtualization team, with the AD team
Data needed: The Tier Zero settings files each server's admins write with the Tier Zero settings script^*, which show VMware Tools on the server.

MITRE ATT&CKT1078

Most useful toDefensive engineers Identity and access engineers

On this page

In plain language

A domain controller that runs as a virtual machine is only as safe as its hypervisor. Whoever administers the ESXi host or vCenter can copy the domain controller's disk and read every password hash offline, take a snapshot of its memory, or open its console, without ever signing in to it.

The hypervisor isn't in the directory, so Pathwarden's attack paths stop at the virtual machine. This finding says the gap is there. Treat the hosts, vCenter and their administrators as Tier Zero, and check who that is.

What Pathwarden flags

Domain controllers, CA servers or other Tier Zero computers run VMware Tools, so they are VMware virtual machines. Pathwarden reads this from the Tier Zero settings file each server's admins write with Get-PathwardenTierZeroSettings.ps1 (the key HKLM\SOFTWARE\VMware, Inc.\VMware Tools).

The ESXi hosts and the vCenter that run these virtual machines are not in the directory, so Pathwarden can't show who administers them. Its attack paths stop at the virtual machine, and a path through the hypervisor is not counted.

How attackers use it

Whoever administers an ESXi host or its vCenter controls every virtual machine on it without signing in to it: they can copy a domain controller's disk and read NTDS.dit offline (every password hash, the krbtgt key), take a snapshot with its memory, or open its console. Ransomware groups go for ESXi and vCenter for that reason, and the ESX Admins group (CVE-2024-37085, PW-029) makes it easier.

Find it with Pathwarden

Data needed: The Tier Zero settings files each server's admins write with the Tier Zero settings script^*, which show VMware Tools on the server.

In the web UI or the HTML report, open the Findings tab and expand PW-039: each finding shows who can use it (its exposure), the attack path drawn out, the affected objects, and the fix. The remediation path tells you whether a single plan step closes it. On the command line:

Shell

# every finding of this rule, with its path and fix
pathwarden findings -i .\collect --rule PW-039
# the step-by-step guide on this page, offline
pathwarden guide PW-039
# after the fix: collect again, then check it is gone
pathwarden retest -i .\collect-after --rule PW-039

Exit codes make retest easy to script: 0 Fixed, 1 Still open, 3 Can't tell. See findings lifecycle and retest.

Before you change anything

List the ESXi hosts, clusters and vCenters that run the computers the finding names (vCenter's inventory, or the VM's summary page).
List who administers them: vCenter roles and permissions, ESXi local accounts, the identity source vCenter trusts, and the backup and replication accounts with access to the datastores.
A Tier Zero settings file over 90 days old can show VMware Tools but can't show it gone; run the script again after moving a server.

How to fix it

Option A: run Tier Zero on a Tier Zero hypervisor

Give the Tier Zero virtual machines their own ESXi cluster (or a dedicated vCenter), administered only by Tier Zero admins, from Tier Zero admin workstations, on a management network apart from the rest.

Option B: harden the shared hypervisor

Grant vCenter and ESXi administration only to Tier Zero admins, and remove vCenter's trust in identity sources outside Tier Zero.
Turn off the ESX Admins automatic grant on every ESXi host joined to the domain (Config.HostAgent.plugins.hostsvc.esxAdminsGroupAutoAdd).
Encrypt the Tier Zero virtual machines (VM encryption with a key provider), so a copied disk can't be read elsewhere.
Keep the datastores and the backups of these virtual machines out of reach of anyone outside Tier Zero.

Then accept this finding as a risk with the reason, so it stays in view.

PowerShell

# On a Tier Zero computer: is it a VMware virtual machine?
Test-Path 'HKLM:\SOFTWARE\VMware, Inc.\VMware Tools'
(Get-CimInstance Win32_ComputerSystem).Manufacturer

Verify the fix

Run Get-PathwardenTierZeroSettings.ps1 on the servers again and analyze with the new files. The finding stays while VMware Tools is there; accept it as a risk once the hypervisor is Tier Zero. A run without a current file from a server keeps the finding open, as can't tell.

Roll back

Nothing changes on the servers. Remove an accepted risk to see the finding again.

References

Microsoft: Enterprise access modellearn.microsoft.com
https://www.vmware.com/docs/vmware-vsphere-8-0-security-configuration-guidevmware.com
https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/microsoft.com
MITRE ATT&CK T1078: Valid Accountsattack.mitre.org

Very new and undergoing testing. These features haven't received a lot of testing yet. Try them out and let us know what's working.