ESXi Vim-Cmd Remove Snapshots

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the use of vim-cmd to remove VM snapshots on ESXi hosts. Threat actors often remove VM snapshots before ransomware deployment to prevent recovery from recent backups, ensure maximum damage by eliminating restoration points, and make recovery more time-consuming and costly for victims. This activity is frequently automated as part of ransomware deployment chains.

2025-05-22 00:00:00

None

5733c5d9-d54f-4bd2-a32c-9b7e4b6f3214

attack.execution attack.t1675 attack.impact attack.t1485

Nextron Sigma feed only (private)