Cross-source coverage
T1673 / ATT&CK
Virtual Machine Discovery
4 rules across 2 sources.
From MITRE ATT&CK 19.2
An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a Hypervisor CLI such as esxcli or vim-cmd (e.g. esxcli vm process list or vim-cmd vmsvc/getallvms). Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host.
Adversaries may use the information from Virtual Machine Discovery during discovery to shape follow-on behaviors. Subsequently discovered VMs may be leveraged for follow-on activities such as Service Stop or Data Encrypted for Impact.
- Tactics
- Discovery
- Platforms
- ESXi · Linux · macOS · Windows
- Telemetry
-
esxi:shellauditd:SYSCALLWinEventLog:Securitymacos:unifiedlog
How MITRE says to detect it DET0199
Detection Strategy for Virtual Machine Discovery
ESXi Analytic 0572
Monitor for execution of hypervisor management commands such as `esxcli vm process list` or `vim-cmd vmsvc/getallvms` that enumerate virtual machines. Defenders observe unexpected users issuing VM listing commands outside normal administrative workflows.
esxi:shellcommand IN ("esxcli vm process list", "vim-cmd vmsvc/getallvms")
Linux Analytic 0573
Detects attempts to enumerate VMs via hypervisor tools like `virsh`, `VBoxManage`, or `qemu-img`. Defender correlates suspicious command invocations with parent process lineage and unexpected users.
auditd:SYSCALLexecve: process_name IN ("virsh", "VBoxManage", "qemu-img") AND command IN ("list", "info")
Windows Analytic 0574
Detects enumeration of VMs using PowerShell (`Get-VM`), VMware Workstation (`vmrun.exe`), or Hyper-V (`VBoxManage.exe`). Defender observes suspicious command lines executed by unexpected users or outside normal administrative sessions.
WinEventLog:SecurityEventCode=4688
macOS Analytic 0575
Detects VM enumeration attempts using virtualization utilities such as VirtualBox (`VBoxManage`) or Parallels CLI. Defender observes abnormal invocation of VM listing commands correlated with non-admin users or unusual parent processes.
macos:unifiedlogprocess_name IN ("VBoxManage", "prlctl") AND command CONTAINS ("list", "show")
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Entra ID Sign-in BloodHound Suite User-Agent Detected | High | Elastic TOML |
| Entra ID Sign-in TeamFiltration User-Agent Detected | High | Elastic TOML |
splunk/security_content
2 rules| Detection | Severity | Format |
|---|---|---|
| ESXi Bulk VM Termination | Undefined | SPL |
| ESXi VM Discovery | Undefined | SPL |