Monitor for execution of hypervisor management commands such as esxcli vm process list or vim-cmd vmsvc/getallvms that enumerate virtual machines. Defenders observe unexpected users issuing VM listing commands outside normal administrative workflows.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | esxi:shell | command IN ("esxcli vm process list", "vim-cmd vmsvc/getallvms") |
| Field | Description |
|---|---|
| ExpectedAdminUsers | List of known administrators authorized to run ESXi enumeration commands. |
| UnexpectedCommandPaths | Defines restricted paths or contexts where VM enumeration should not occur. |
Detects attempts to enumerate VMs via hypervisor tools like virsh, VBoxManage, or qemu-img. Defender correlates suspicious command invocations with parent process lineage and unexpected users.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | auditd:SYSCALL | execve: process_name IN ("virsh", "VBoxManage", "qemu-img") AND command IN ("list", "info") |
| Field | Description |
|---|---|
| NonRootAccounts | Monitor non-root users invoking hypervisor management utilities. |
| KnownAdminScripts | Whitelist of scripts expected to run VM enumeration as part of routine operations. |
Detects enumeration of VMs using PowerShell (Get-VM), VMware Workstation (vmrun.exe), or Hyper-V (VBoxManage.exe). Defender observes suspicious command lines executed by unexpected users or outside normal administrative sessions.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Security | EventCode=4688 |
| Field | Description |
|---|---|
| ExpectedAdminAccounts | Defines which accounts are authorized to execute VM discovery commands. |
| RoutineScripts | Whitelist of approved administrative scripts that legitimately invoke VM enumeration. |
Detects VM enumeration attempts using virtualization utilities such as VirtualBox (VBoxManage) or Parallels CLI. Defender observes abnormal invocation of VM listing commands correlated with non-admin users or unusual parent processes.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | macos:unifiedlog | process_name IN ("VBoxManage", "prlctl") AND command CONTAINS ("list", "show") |
| Field | Description |
|---|---|
| UserContext | Adjust sensitivity depending on whether the command is executed by admin or non-admin users. |
| ExecutionTimeWindow | Restrict alerts to unusual times when VM management is not expected. |