ESXi Virtual Machine Process Killed

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Virtual Machine Process Killed

Detects termination of a virtual machine process on an ESXi host, including esxcli vm process kill, pkill of vmx processes, and vmdumper suspend. A running VM holds a lock on its disks. Stopping the process releases that lock and makes the disks writable.

Rule type: query

Rule indices:

logs-vsphere.log-*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Endpoint
Data Source: VMware vSphere
Use Case: Threat Detection
Tactic: Impact
Resources: Investigation Guide
Rule Type: Custom Query (KQL)
Platform: VMware ESXi
Threat: Ransomware

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Virtual Machine Process Killed

Stopping vmx releases the lock on a virtual disk. ESXi ransomware does this immediately before it encrypts files under /vmfs/volumes.

Possible investigation steps

Read the full command in message and event.original. Note --type (soft, hard, force), --world-id / -w, and whether the line is an awk loop over vm process list.
Identify the account and source from the same host in /var/log/shell.log and /var/log/auth.log around @timestamp.
Check whether the same session listed VMs, searched for *.vmdk, removed snapshots, or reset the syslog loghost.
Confirm with the VM owner whether that world id was shut down on purpose.

False positive analysis

Maintenance and crash recovery use the same esxcli kill types. A single soft shutdown of a named VM during a change window is often expected. A loop that kills every world id is not.

Response and remediation

If the kill was not approved, isolate the host from the management network and stop further shell activity.
Leave powered-on VMs running. Shutting them down releases disk locks and lets encryption continue.
Preserve shell.log, hostd.log, and auth.log, and restore any VM that was stopped from a known-good backup.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit

data_stream.dataset:vsphere.log and message:("vm process kill" or pkill and vmx or suspend_v and vmdumper)

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Impact
- ID: TA0040
- Reference URL: https://attack.mitre.org/tactics/TA0040/
Technique:
- Name: Service Stop
- ID: T1489
- Reference URL: https://attack.mitre.org/techniques/T1489/

« ESXi Virtual Machine Powered Off ESXi Root Password Accepted from Remote Host »