Skip to content

Hide Navigation Hide TOC

ESXi VM Kill Via ESXCLI (2992ac4d-31e9-4325-99f2-b18a73221bb2)

Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

Cluster A Galaxy A Cluster B Galaxy B Level
ESXi VM Kill Via ESXCLI (2992ac4d-31e9-4325-99f2-b18a73221bb2) Sigma-Rules System Shutdown/Reboot - T1529 (ff73aa03-0090-4464-83ac-f89e233c02bc) Attack Pattern 1
ESXi VM Kill Via ESXCLI (2992ac4d-31e9-4325-99f2-b18a73221bb2) Sigma-Rules Hypervisor CLI - T1059.012 (d2d642da-61ff-4211-b4df-7923c9ca220c) Attack Pattern 1
Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern Hypervisor CLI - T1059.012 (d2d642da-61ff-4211-b4df-7923c9ca220c) Attack Pattern 2