AN0572
Analytic 0572
ESXi
Monitor for execution of hypervisor management commands such as `esxcli vm process list` or `vim-cmd vmsvc/getallvms` that enumerate virtual machines. Defenders observe unexpected users issuing VM listing commands outside normal administrative workflows.
esxi:shell
command IN ("esxcli vm process list", "vim-cmd vmsvc/getallvms")
[ExpectedAdminUsers]
List of known administrators authorized to run ESXi enumeration commands.
[UnexpectedCommandPaths]
Defines restricted paths or contexts where VM enumeration should not occur.
AN0573
Analytic 0573
Linux
Detects attempts to enumerate VMs via hypervisor tools like `virsh`, `VBoxManage`, or `qemu-img`. Defender correlates suspicious command invocations with parent process lineage and unexpected users.
auditd:SYSCALL
execve: process_name IN ("virsh", "VBoxManage", "qemu-img") AND command IN ("list", "info")
[NonRootAccounts]
Monitor non-root users invoking hypervisor management utilities.
[KnownAdminScripts]
Whitelist of scripts expected to run VM enumeration as part of routine operations.
AN0574
Analytic 0574
Windows
Detects enumeration of VMs using PowerShell (`Get-VM`), VMware Workstation (`vmrun.exe`), or Hyper-V (`VBoxManage.exe`). Defender observes suspicious command lines executed by unexpected users or outside normal administrative sessions.
WinEventLog:Security
EventCode=4688
[ExpectedAdminAccounts]
Defines which accounts are authorized to execute VM discovery commands.
[RoutineScripts]
Whitelist of approved administrative scripts that legitimately invoke VM enumeration.
AN0575
Analytic 0575
macOS
Detects VM enumeration attempts using virtualization utilities such as VirtualBox (`VBoxManage`) or Parallels CLI. Defender observes abnormal invocation of VM listing commands correlated with non-admin users or unusual parent processes.
macos:unifiedlog
process_name IN ("VBoxManage", "prlctl") AND command CONTAINS ("list", "show")
[UserContext]
Adjust sensitivity depending on whether the command is executed by admin or non-admin users.
[ExecutionTimeWindow]
Restrict alerts to unusual times when VM management is not expected.