T1673 · Virtual Machine Discovery

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1673 · Virtual Machine Discovery · Sunturai

attack-patternenterprise-attackT1673

Virtual Machine Discovery

attack-pattern--6bc7f9aa-b91f-4b23-84b8-5e756eba68eb

An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a Hypervisor CLI such as `esxcli` or `vim-cmd` (e.g. `esxcli vm process list or vim-cmd vmsvc/getallvms`).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021) (Citation: TrendMicro Play) Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host. Adversaries may use the information from Virtual Machine Discovery during discovery to shape follow-on behaviors. Subsequently discovered VMs may be leveraged for follow-on activities such as Service Stop or Data Encrypted for Impact.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)

Created: Mar 27, 2025, 3:32 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

4 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
ESXi Bulk VM Termination	Medium	Splunk security content	Sep 22, 2026	Apache License 2.0
Entra ID Sign-in TeamFiltration User-Agent Detected	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Entra ID Sign-in BloodHound Suite User-Agent Detected	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
ESXi VM Discovery	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0

Showing 4 of 4

Filter in the catalogue

External references

mitre-attackT1673Open reference

TrendMicro PlayOpen reference

Crowdstrike Hypervisor Jackpotting Pt 2 2021Open reference

Platforms

ESXiLinuxmacOSWindows

Kill chain phases

discovery

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object