Virtual Machine Discovery T1673

Tactic: Discovery

An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a Hypervisor CLI such as `esxcli` or `vim-cmd` (e.g. `esxcli vm process list or vim-cmd vmsvc/getallvms`). Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host.

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (8 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
aws::userAgent2eq 1, regex_match 1(azure|sharp|blood)(hound)/.*, mozilla/5.0 (windows nt 10.0; win64; x64)...
data_stream.dataset2eq 1, in 1azure.activitylogs, azure.auditlogs, azure.graphactivitylogs, azure.signinlogs, o365.audit
sourcetype2in 2vmw-syslog, vmware:esxlog*
Message1contains 1esxcli vm process, list
command1contains 1, is_not_null 1, starts_with 1--format-param, awk, esxcli
user_agent.name1eq 1electron
user_agent.os.name1eq 1windows
user_agent.version1eq 18.5.1

Top indicator values (22 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
sourcetypein
vmw-syslog
223
sourcetypein
vmware:esxlog*
223
Messagecontains
esxcli vm process
1
Messagecontains
list
1
aws::userAgenteq
mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like...
1
aws::userAgentregex_match
(azure|sharp|blood)(hound)/.*
1
commandcontains
--format-param
1
commandcontains
awk
1
commandcontains
esxcli
1
commandcontains
esxcli vm process kill
1
commandcontains
vm process list
1
commandstarts_with
pkill -9 vmx-
1
data_stream.dataseteq
azure.activitylogs
139
data_stream.dataseteq
azure.auditlogs
126
data_stream.dataseteq
azure.graphactivitylogs
15
data_stream.dataseteq
azure.signinlogs
136
data_stream.dataseteq
o365.audit
147
data_stream.datasetin
azure.signinlogs
15
data_stream.datasetin
o365.audit
13
user_agent.nameeq
electron
1
user_agent.os.nameeq
windows
1
user_agent.versioneq
8.5.1
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Elastic 2 rules

Splunk 2 rules