Rule Info
Name
Virtual Machine Suspended Via VMdumper
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects the execution of "VMdumper" with the "suspend_v" flag, which allows a user to suspend a running running virtual machine pn ESXi servers.
The LockBit ransomware was seen using this technique before encrypting the VMs.
Date
2024-08-14 00:00:00
Modified
None
Id
09234c6b-4b49-4564-886a-2704f5a0b48e
Tags
attack.execution
Type
Nextron Sigma feed only (private)