Enumerate All Virtual Machines Via Vim-Cmd

Rule Info

Name
Enumerate All Virtual Machines Via Vim-Cmd
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects the execution of "vim-cmd" with the "vmsvc/getallvms" flag, in order to enumerate all virtual machines that are registered on an ESXi host. This command was seen being used by ransomware operators to collect all VM ids, to initiate their shutdown afterwards.
Reference
https://knowledge.broadcom.com/external/article/308360/performing-common-virtual-machinerelated.html
Date
2024-08-14 00:00:00
Modified
None
Id
89ea07fb-32e0-4c32-862f-fe9a881186c4
Tags
attack.execution
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022