T1673 — Virtual Machine Discovery

Tactic: Discovery · Platforms: ESXi, Linux, macOS, Windows

An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a Hypervisor CLI such as `esxcli` or `vim-cmd` (e.g. `esxcli vm process list or vim-cmd…

Sigma detection rules (4)

T1673 Virtual Machine Discovery

title: T1673 Virtual Machine Discovery
id: 3346a631-6f19-457b-9cc4-b122a51921e8
description: 'Detects enumeration of virtual machines via PowerCLI (Connect-VIServer / Get-VM), Hyper-V PowerShell cmdlets (Get-VM), or ESXi hypervisor-CLI commands (esxcli vm process list, vim-cmd vmsvc/getallvms) invoked from a Windows host acting as an admin workstation or jump box for hypervisor management. Tune using: ExpectedAdminAccounts, RoutineScripts.'
references:
  - https://attack.mitre.org/techniques/T1673
author: Shahrukh Khan
date: 2026-06-17
license: MIT
tags:
  - attack.discovery
  - attack.t1673

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_shell_vm_enum:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-VM'
      - 'Connect-VIServer'
  selection_esxi_cli:
    CommandLine|contains:
      - 'esxcli vm process list'
      - 'vim-cmd vmsvc/getallvms'

  condition: selection_shell_vm_enum or selection_esxi_cli

falsepositives:
  - Legitimate virtualization/hypervisor administration via PowerCLI, Hyper-V Manager automation, or routine ESXi maintenance scripts run from a management jump host.

level: low

T1673 Virtual Machine Discovery

title: T1673 Virtual Machine Discovery
id: 10f904fd-1070-4f86-b840-c57f0e22a054
description: 'Detection Strategy for Virtual Machine Discovery via hypervisor/VM management CLI enumeration (esxcli, vim-cmd, virsh, VBoxManage, qm) and their list/enumerate subcommands - the actual behavior this technique describes. (The previous version matched ss/netstat/find against /etc/passwd, /etc/shadow, -perm, -tulpn, which is SUID/permission hunting and listening-port discovery, unrelated to VM enumeration.) Tune using: NonRootAccounts, KnownAdminScripts.'
references:
  - https://attack.mitre.org/techniques/T1673
author: Shahrukh Khan
date: 2026-04-10
license: MIT
tags:
  - attack.discovery
  - attack.t1673

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/esxcli'
      - '/vim-cmd'
      - '/virsh'
      - '/VBoxManage'
      - '/qm'
    a1|contains:
      - 'list'
      - 'getallvms'
      - 'vmsvc'

  condition: selection

falsepositives:
  - Hypervisor admins and monitoring/backup agents routinely enumerate VMs with these same commands; scope KnownAdminScripts to exclude already-approved backup/inventory tooling and expected NonRootAccounts.

level: medium

T1673 Virtual Machine Discovery

title: T1673 Virtual Machine Discovery
id: 24ad4502-8bcb-4fa2-b38b-af771aa35fec
description: 'Detection Strategy for Virtual Machine Discovery. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, ExecutionTimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1673
author: Shahrukh Khan
date: 2026-05-06
license: MIT
tags:
  - attack.discovery
  - attack.t1673

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/system_profiler'
      - '/ioreg'
      - '/sysctl'
    CommandLine|contains:
      - 'SPHardwareDataType'
      - 'IOPlatformUUID'
      - 'hw.model'

  condition: selection

falsepositives:
  - Legitimate license-check or telemetry code in commercial software that queries hardware identifiers to detect virtualization for support purposes.

level: low

T1673 Virtual Machine Discovery

title: T1673 Virtual Machine Discovery
id: 3d89e49a-99ae-4f8e-a4d8-5cdd38f12039
description: 'Detection Strategy for Virtual Machine Discovery. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExpectedAdminUsers, UnexpectedCommandPaths.'
references:
  - https://attack.mitre.org/techniques/T1673
author: Shahrukh Khan
date: 2026-01-24
license: MIT
tags:
  - attack.discovery
  - attack.t1673

logsource:
  category: process_creation
  product: esxi

detection:
  selection:
    CommandLine|contains:
      - 'vim-cmd vmsvc/getallvms'
      - 'esxcli storage filesystem list'
      - 'esxcli network ip interface list'
      - 'esxcli hardware platform get'

  condition: selection

falsepositives:
  - Routine infrastructure inventory scripts and monitoring agents run these exact commands constantly; only actionable when the executing account falls outside ExpectedAdminUsers or the command originates from an UnexpectedCommandPaths location.

level: low

Explore