Techniques › T1673
T1673 Virtual Machine Discovery
discovery — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1673
0
KEV CVEs mapped here
<p>An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a Hypervisor CLI such as
esxcli or vim-cmd (e.g. esxcli vm process list or vim-cmd vmsvc/getallvms). Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host.</p><p>Adversaries may use the information from Virtual Machine Discovery during discovery to shape follow-on behaviors. Subsequently discovered VMs may be leveraged for follow-on activities such as Service Stop or Data Encrypted for Impact.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0199 Detection Strategy for Virtual Machine Discovery v1.0
AN0572 ESXiMonitor for execution of hypervisor management commands such as
esxcli vm process listorvim-cmd vmsvc/getallvmsthat enumerate virtual machines. Defenders observe unexpected users issuing VM listing commands outside normal administrative workflows.esxi:shellcommand IN ("esxcli vm process list", "vim-cmd vmsvc/getallvms")→ DC0064 Command ExecutionTunable:ExpectedAdminUsersUnexpectedCommandPathsAN0573 LinuxDetects attempts to enumerate VMs via hypervisor tools likevirsh,VBoxManage, orqemu-img. Defender correlates suspicious command invocations with parent process lineage and unexpected users.auditd:SYSCALLexecve: process_name IN ("virsh", "VBoxManage", "qemu-img") AND command IN ("list", "info")→ DC0064 Command ExecutionTunable:NonRootAccountsKnownAdminScriptsAN0574 WindowsDetects enumeration of VMs using PowerShell (Get-VM), VMware Workstation (vmrun.exe), or Hyper-V (VBoxManage.exe). Defender observes suspicious command lines executed by unexpected users or outside normal administrative sessions.Tunable:ExpectedAdminAccountsRoutineScriptsAN0575 macOSDetects VM enumeration attempts using virtualization utilities such as VirtualBox (VBoxManage) or Parallels CLI. Defender observes abnormal invocation of VM listing commands correlated with non-admin users or unusual parent processes.macos:unifiedlogprocess_name IN ("VBoxManage", "prlctl") AND command CONTAINS ("list", "show")→ DC0032 Process CreationTunable:UserContextExecutionTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1673
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.