ESXi Power Off VM via Vim-Cmd

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to power off virtual machines using vim-cmd, which is commonly observed during ransomware attacks. This command can be used to shut down or power off virtual machines on ESXi hosts. Adversaries may use this technique to disrupt operations, cause data loss, or prepare the environment for further exploitation.

2025-05-22 00:00:00

None

456b5c1d-15d0-4411-9455-6e5c9f0dba6d

attack.execution attack.t1675 attack.impact attack.t1529

Nextron Sigma feed only (private)