« ESXi Virtual Disk Files Enumerated ESXi Virtual Machine Process Killed »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

ESXi Virtual Machine Powered Off

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Virtual Machine Powered Off

edit

Detects vim-cmd vmsvc/power.off on an ESXi host. Powering a virtual machine off releases the lock the hypervisor holds on its virtual disks. With the guest stopped, those disks can be rewritten or encrypted while the machine is down.

Rule type: query

Rule indices:

  • logs-vsphere.log-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Impact
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi
  • Threat: Ransomware

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Virtual Machine Powered Off

vim-cmd vmsvc/power.off is the guest-aware shutdown path ransomware uses when esxcli vm process kill is not enough. A for loop over getallvms powers off every guest on the host.

Possible investigation steps

  • Read message for a single VM id versus a loop over vim-cmd vmsvc/getallvms.
  • Correlate with snapshot removal, vm process kill, and find commands for *.vmdk on the same host.
  • Ask the VM owner whether that power-off was scheduled.

False positive analysis

One VM powered off by a known administrator during a change window is commonly benign. Powering off every VM in one shell loop is the ransomware pattern.

Response and remediation

  • If the power-off was not approved, isolate the host and do not reboot it.
  • Power guests back on only after confirming their disks were not encrypted, or restore them from backup.
  • Preserve shell and hostd logs for the session that issued power.off.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit
data_stream.dataset: "vsphere.log" and (
  message: "vmsvc/power.off"
)

Framework: MITRE ATT&CKTM

« ESXi Virtual Disk Files Enumerated ESXi Virtual Machine Process Killed »