Hypervisor CLI or cmdlet used to list virtual machines

1title: Hypervisor CLI or cmdlet used to list virtual machines2id: 08e2ae94-3c36-494d-9706-a3c67bdd193b3status: experimental4description: |5  Matches the enumeration half of AN0574: a virtualisation management binary6  invoked with a listing verb, and the PowerShell route through the Get-VM7  family. The tool list is the analytic's own naming, populated here with the8  Workstation CLI (vmrun.exe), the VirtualBox CLI (VBoxManage.exe) and the9  Windows PowerShell hosts; the verb gate is what separates discovery from10  ordinary VM lifecycle work, because VBoxManage.exe startvm and vmrun.exe11  start are the same binaries doing something that is not this technique. The12  Get-VM selection deliberately matches the prefix rather than the exact13  cmdlet, so Get-VMHost, Get-VMSwitch and Get-VMGuest are caught alongside it;14  all of them are the same enumeration step against a different object.15  Three gaps to be plain about. The brief maps Security EventID 4688 onto16  Sigma's process_creation category, which is Sysmon-shaped, so this rule is17  written in that vocabulary (Image, CommandLine) — a Sysmon EventID 1 feed18  matches directly, while a 4688 feed needs NewProcessName mapped onto Image19  first, plus Audit Process Creation enabled and the separate "Include command20  line in process creation events" policy, without which CommandLine is empty21  and no selection in this rule can ever match. A cmdlet typed into an already22  running console, or called from inside a .ps1, never appears on any process23  command line at all; that route is only visible on PowerShell EventID 410424  with Script Block Logging enabled, which is a different logsource and cannot25  be joined here. Finally, ESXi is where this technique matters most and the26  esxcli and vim-cmd invocations MITRE cites run on the hypervisor itself,27  which emits no Windows process creation events — this rule does not reach28  them.29  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0199, not hand-written and not tested by its author. Any lab result is on this rule's own page.30references:31  - https://attack.mitre.org/techniques/T167332  - https://attack.mitre.org/detectionstrategies/DET019933author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)34date: 2026-08-1635tags:36  - attack.discovery37  - attack.t167338logsource:39  category: process_creation40  product: windows41detection:42  selection_vm_cli:43    Image|endswith:44      - '\vmrun.exe'45      - '\VBoxManage.exe'46    CommandLine|contains:47      - ' list'48      - ' showvminfo'49  selection_powershell:50    Image|endswith:51      - '\powershell.exe'52      - '\pwsh.exe'53    CommandLine|contains:54      - 'Get-VM'55  condition: 1 of selection*56falsepositives:57  - "Backup, replication and monitoring agents on virtualisation hosts. Veeam, DPM and Zabbix/Nagios check scripts call powershell.exe -Command Get-VM on a schedule to build their inventory, so on any Hyper-V or vCenter-managed host this is the highest-volume match by a wide margin — a fixed rhythm from a service account, once per poll interval per host — and is why this rule is low rather than medium."58  - "Vagrant and Packer on developer workstations and build agents. The VirtualBox provider shells out to VBoxManage.exe list vms and VBoxManage.exe showvminfo on every vagrant up, vagrant status and vagrant halt, and Packer does the same during each image build, so an ordinary developer day produces dozens of matches from a legitimate parent."59  - "Administrators and inventory tooling doing exactly what the technique describes, benignly — an operator running Get-VM to see what is on a host before patching, or a nightly asset-collection script that reports VM names into a CMDB. Nothing in this rule distinguishes that from an adversary's first look at the same host; only the account and the parent process do."60  - "Virtualisation product self-checks and installers, where the vendor's own updater or diagnostics bundle runs vmrun.exe list to confirm nothing is running before an upgrade, appearing as a one-off burst across the fleet during a rollout."61level: low