ESXi Virtual Machine Process List

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Virtual Machine Process List

Detects esxcli vm process list on an ESXi host. The command lists running virtual machines and the world IDs of their vmx processes. Those IDs are what a later kill command uses to stop the VMs and release the locks on their virtual disks.

Rule type: query

Rule indices:

logs-vsphere.log-*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Endpoint
Data Source: VMware vSphere
Use Case: Threat Detection
Tactic: Discovery
Resources: Investigation Guide
Rule Type: Custom Query (KQL)
Platform: VMware ESXi
Threat: Ransomware

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Virtual Machine Process List

esxcli vm process list enumerates running virtual machines and their world ids. A later kill command uses those world ids to stop the VMs.

Possible investigation steps

Read message for a plain list versus a list piped into vm process kill.
Check the same session for pkill, power.off, snapshot removal, or a search for vmdk files.
Confirm with the virtualization owner whether the list was part of a scheduled check.

False positive analysis

A standalone list during a change window is commonly benign. A list immediately followed by a force kill of every world id is the shutdown step before encryption.

Response and remediation

If the same session kills virtual machines or deletes snapshots, isolate the host.
Otherwise record the account and source for hunting on other hosts.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit

data_stream.dataset: "vsphere.log" and event.module: "vsphere" and message: ("esxcli" and "vm process list")

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Discovery
- ID: TA0007
- Reference URL: https://attack.mitre.org/tactics/TA0007/
Technique:
- Name: Process Discovery
- ID: T1057
- Reference URL: https://attack.mitre.org/techniques/T1057/

« ESXi Virtual Machine Process Killed ESXi Virtual Machine Snapshot Removed »