Hypervisor CLI or cmdlet used to list virtual machines

Siemphony@siemphonylowT1673unverified

Matches the enumeration half of AN0574: a virtualisation management binary invoked with a listing verb, and the PowerShell route through the Get-VM family. The tool list is the analytic's own naming, populated here with the Workstation CLI (vmrun.exe), the VirtualBox CLI (VBoxManage.exe) and the Windows PowerShell hosts; the verb gate is what separates discovery from ordinary VM lifecycle work, because VBoxManage.exe startvm and vmrun.exe start are the same binaries doing something that is not this technique. The Get-VM selection deliberately matches the prefix rather than the exact cmdlet, so Get-VMHost, Get-VMSwitch and Get-VMGuest are caught alongside it; all of them are the same enumeration step against a different object. Three gaps to be plain about. The brief maps Security EventID 4688 onto Sigma's process_creation category, which is Sysmon-shaped, so this rule is written in that vocabulary (Image, CommandLine) — a Sysmon EventID 1 feed matches directly, while a 4688 feed needs NewProcessName mapped onto Image first, plus Audit Process Creation enabled and the separate "Include command line in process creation events" policy, without which CommandLine is empty and no selection in this rule can ever match. A cmdlet typed into an already running console, or called from inside a .ps1, never appears on any process command line at all; that route is only visible on PowerShell EventID 4104 with Script Block Logging enabled, which is a different logsource and cannot be joined here. Finally, ESXi is where this technique matters most and the esxcli and vim-cmd invocations MITRE cites run on the hypervisor itself, which emits no Windows process creation events — this rule does not reach them. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0199, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\vmrun.exe" or FolderPath endswith "\\VBoxManage.exe") and (ProcessCommandLine contains " list" or ProcessCommandLine contains " showvminfo")) or ((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and ProcessCommandLine contains "Get-VM"))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\vmrun.exe" OR Image="*\\VBoxManage.exe") AND (CommandLine="* list*" OR CommandLine="* showvminfo*")) OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND CommandLine="*Get-VM*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\vmrun.exe" OR TO_LOWER(process.executable) LIKE "*\\\\vboxmanage.exe") AND (TO_LOWER(process.command_line) LIKE "* list*" OR TO_LOWER(process.command_line) LIKE "* showvminfo*")) OR ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND TO_LOWER(process.command_line) LIKE "*get-vm*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\vmrun\.exe$|\\VBoxManage\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)( list| showvminfo)</field>    <description>Hypervisor CLI or cmdlet used to list virtual machines (1/2)</description>    <mitre>      <id>T1673</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)Get-VM</field>    <description>Hypervisor CLI or cmdlet used to list virtual machines (2/2)</description>    <mitre>      <id>T1673</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 08e2ae94-3c36-494d-9706-a3c67bdd193b

ATT&CKT1673

T1673Virtual Machine Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

The Windows arm of DET0199: an operator or adversary asking a virtualisation tool "what VMs are on this box?" before deciding what to do next. AN0574 names the three routes — PowerShell Get-VM, VMware Workstation's vmrun.exe, and VBoxManage.exe — and the rule covers all three from process creation events. What it does not reach is worth saying first. ESXi is where this technique matters most, and the esxcli and vim-cmd invocations MITRE cites run on the hypervisor itself, which emits no Windows process creation events at all. The Linux (AN0573: virsh, qemu-img) and macOS (AN0575: prlctl) arms of the same strategy are separate log sources and are not written here.

02 · Telemetry you need

process_creation on product: windows, copied verbatim from AN0574. The brief maps Security EventID 4688 onto that Sigma category, but the category is Sysmon-shaped, so the rule is written in Sysmon vocabulary: Image and CommandLine. A Sysmon EventID 1 feed matches directly. A 4688 feed does not — NewProcessName has to be mapped onto Image first, and 4688 needs Audit Process Creation enabled plus the separate Include command line in process creation events policy. Without that second policy CommandLine is empty and no selection in this rule can ever fire.
A second blind spot: a cmdlet typed into an already-running console, or called from inside a .ps1, never appears on any process command line. That route is only visible on PowerShell EventID 4104 with Script Block Logging on — a different log source that cannot be joined here.

03 · How the logic works

Two independent selections, joined by 1 of selection*. selection_vm_cli requires Image|endswith on \vmrun.exe or \VBoxManage.exe and CommandLine|contains one of ' list' or ' showvminfo'. The verb gate is the point of the block: both binaries have lifecycle verbs — VBoxManage.exe startvm, vmrun.exe start — that are the same tool doing something that is not discovery. Note the sharp edge here: the two binaries share one verb list, and list is VBoxManage's generic enumerator. VBoxManage list bridgedifs, list usbhost, list extpacks and roughly twenty more subjects satisfy it while enumerating no virtual machines. Splitting the block per binary — ' list vms'/' list runningvms' for VBoxManage, bare ' list' for vmrun — is the first fix to apply. selection_powershell requires powershell.exe or pwsh.exe with CommandLine|contains 'Get-VM'. That is a prefix, not the exact cmdlet, so Get-VMHost, Get-VMGuest and Get-VMSwitch all match. This is a deliberate over-match: pinning to the exact cmdlet loses the PowerCLI and Hyper-V variants. Get-VMSwitch is the one that genuinely is not this technique — it is network configuration discovery. Both arms are string matches and evade cheaply: a renamed VBoxManage.exe (it runs fine from any path under any name) defeats the first, and -EncodedCommand or &('Get-'+'VM') defeats the second. Adding OriginalFileName as an alternative to Image helps on Sysmon EID 1, which has that field; 4688 does not.

04 · Common false positives

Backup, replication and monitoring agents that run PowerShell inventory scripts via powershell.exe -File/-Command are the highest-volume match by a wide margin on any Hyper-V host — a fixed rhythm from a service account, once per poll interval. Vagrant and Packer shell out to VBoxManage.exe list vms on every vagrant up, status and halt. And administrators doing exactly what the technique describes, benignly, are indistinguishable here on logic alone. That last point is why level: low.

05 · Detection maturity

tier_1: Lowest tier. This rule has never been executed against a log line; it is derived from MITRE ATT&CK v19.2 and labelled UNVERIFIED for that reason. It cannot move up until it has been run against real telemetry, the field mapping confirmed to resolve, and the false positive rate measured rather than guessed.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's ExpectedAdminAccounts and RoutineScripts knobs are the two levers AN0574 offers: which accounts may run VM discovery, and which approved scripts legitimately do it. Both are estate-specific and empty until someone fills them. In practice the account and the parent process carry all the separation — the command line carries none.

Declared by the author

Backup, replication and monitoring agents on virtualisation hosts. Veeam, DPM and Zabbix/Nagios check scripts call powershell.exe -Command Get-VM on a schedule to build their inventory, so on any Hyper-V or vCenter-managed host this is the highest-volume match by a wide margin — a fixed rhythm from a service account, once per poll interval per host — and is why this rule is low rather than medium.
Vagrant and Packer on developer workstations and build agents. The VirtualBox provider shells out to VBoxManage.exe list vms and VBoxManage.exe showvminfo on every vagrant up, vagrant status and vagrant halt, and Packer does the same during each image build, so an ordinary developer day produces dozens of matches from a legitimate parent.
Administrators and inventory tooling doing exactly what the technique describes, benignly — an operator running Get-VM to see what is on a host before patching, or a nightly asset-collection script that reports VM names into a CMDB. Nothing in this rule distinguishes that from an adversary's first look at the same host; only the account and the parent process do.
Virtualisation product self-checks and installers, where the vendor's own updater or diagnostics bundle runs vmrun.exe list to confirm nothing is running before an upgrade, appearing as a one-off burst across the fleet during a rollout.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1673, evaluated against their process_creation events.

Share this rule

/u/siemphony/08e2ae94-3c36-494d-9706-a3c67bdd193b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Hypervisor CLI or cmdlet used to list virtual machines

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it