Delete Virtual Machine Snapshot Via Vim-Cmd

Nasreddine Bencherchali (Nextron Systems)

Detects the execution of "vim-cmd" with the "vmsvc/snapshot.removeall" flag, in order to remove all snapshots for a specific virtual machine on an ESXi host. This command was seen being used by ransomware operators in order to remove all snapshot before initiating the encryption process.

2024-08-14 00:00:00

None

2660d321-5144-435b-be3a-13240369fab2

attack.execution

Nextron Sigma feed only (private)