tfMITRE ATT&CK technique

Virtual Machine Discovery T1673

Tactic: Discovery
Platforms: ESXi, Linux, macOS, Windows
Version: 1.0
Created: 27 March 2025
Last modified: 12 May 2026
Contributor: Janantha Marasinghe

An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a Hypervisor CLI such as esxcli or vim-cmd (e.g. esxcli vm process list or vim-cmd vmsvc/getallvms).[1][2] Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 57% of ATT&CK techniques have fewer tools implementing them.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

tfMITRE ATT&CK technique

Virtual Machine Discovery T1673

Tactic: Discovery
Platforms: ESXi, Linux, macOS, Windows
Version: 1.0
Created: 27 March 2025
Last modified: 12 May 2026
Contributor: Janantha Marasinghe

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 57% of ATT&CK techniques have fewer tools implementing them.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Virtual Machine Discovery MITRE reference T1673

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has used scripts to enumerate ESXi hypervisors and their guest VMs.1

created 2025-05-291 reference

All 1 groups for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

PureCrypterS9019 ↗

Can identify virtual machines by querying the WMI object Win32_ComputerSystem for manufacturer and model and check it against the regular expression Microsoft|VMWare|Virtual.1

created 2026-04-16MALWAREcarried by 1 group

QilinS1242 ↗

Can detect virtual machine environments including ESXi hosts, datacenters, and clusters within vCenter environments.1 2

created 2025-09-26MALWAREcarried by 2 groups

VIRTUALPITAS1217 ↗

Can target specific guest virtual machines for script execution.1

created 2025-06-02MALWAREcarried by 1 group

CheerscryptS1096 ↗

Has leveraged esxcli vm process list in order to gather a list of running virtual machines to terminate them.1

created 2023-12-18MALWAREcarried by 1 group

All 4 software entries for this technique

Offense vs defense T1673

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 2

Virtual Machine Discovery detection strategy DET0199

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Virtual Machine Discovery

Enterprise

4 platforms

AN0572 · ESXi

Monitor for execution of hypervisor management commands such as esxcli vm process list or vim-cmd vmsvc/getallvms that enumerate virtual machines. Defenders observe unexpected users issuing VM listing commands outside normal administrative workflows.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	esxi:shell	command IN ("esxcli vm process list", "vim-cmd vmsvc/getallvms")

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExpectedAdminUsers	List of known administrators authorized to run ESXi enumeration commands.
UnexpectedCommandPaths	Defines restricted paths or contexts where VM enumeration should not occur.

AN0573 · Linux

Detects attempts to enumerate VMs via hypervisor tools like virsh, VBoxManage, or qemu-img. Defender correlates suspicious command invocations with parent process lineage and unexpected users.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	auditd:SYSCALL	execve: process_name IN ("virsh", "VBoxManage", "qemu-img") AND command IN ("list", "info")

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
NonRootAccounts	Monitor non-root users invoking hypervisor management utilities.
KnownAdminScripts	Whitelist of scripts expected to run VM enumeration as part of routine operations.

AN0574 · Windows

Detects enumeration of VMs using PowerShell (Get-VM), VMware Workstation (vmrun.exe), or Hyper-V (VBoxManage.exe). Defender observes suspicious command lines executed by unexpected users or outside normal administrative sessions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExpectedAdminAccounts	Defines which accounts are authorized to execute VM discovery commands.
RoutineScripts	Whitelist of approved administrative scripts that legitimately invoke VM enumeration.

AN0575 · macOS

Detects VM enumeration attempts using virtualization utilities such as VirtualBox (VBoxManage) or Parallels CLI. Defender observes abnormal invocation of VM listing commands correlated with non-admin users or unusual parent processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process_name IN ("VBoxManage", "prlctl") AND command CONTAINS ("list", "show")

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Adjust sensitivity depending on whether the command is executed by admin or non-admin users.
ExecutionTimeWindow	Restrict alerts to unusual times when VM management is not expected.

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk		The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.	Generic	stable	-	esxi	VMware ESXi · VMware	Impact Endpoint Denial of Service Impact System Shutdown/Reboot Discovery Virtual Machine Discovery	-	medium	Raven Tait, Splunk	2025-07-11	2026-09-08	cfe094b4-0737-4a33-9d63-e0562ce2b883
Splunk		This detection identifies the use of ESXCLI commands to discover virtual machines on an ESXi host While used by administrators, this activity may also indicate adversary reconnaissance aimed at identifying high value targets, mapping the virtual environment, or preparing for data theft or destructive operations.	Generic	stable	-	esxi	VMware ESXi · VMware	Discovery Virtual Machine Discovery	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	5643cdc9-a0be-4123-860b-f13da0bf4fcb	-

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk		The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.	Generic	stable	-	esxi	VMware ESXi · VMware	Impact Endpoint Denial of Service Impact System Shutdown/Reboot Discovery Virtual Machine Discovery	-	medium	Raven Tait, Splunk	2025-07-11	2026-09-08	cfe094b4-0737-4a33-9d63-e0562ce2b883
Splunk		This detection identifies the use of ESXCLI commands to discover virtual machines on an ESXi host While used by administrators, this activity may also indicate adversary reconnaissance aimed at identifying high value targets, mapping the virtual environment, or preparing for data theft or destructive operations.	Generic	stable	-	esxi	VMware ESXi · VMware	Discovery Virtual Machine Discovery	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	5643cdc9-a0be-4123-860b-f13da0bf4fcb	-

Virtual Machine Discovery T1673

Virtual Machine Discovery T1673

Virtual Machine Discovery MITRE reference T1673

Offense vs defense T1673

Virtual Machine Discovery detection strategy DET0199

Detection Strategy for Virtual Machine Discovery

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Virtual Machine Discovery MITRE reference T1673

Offense vs defense T1673

Virtual Machine Discovery detection strategy DET0199

Detection Strategy for Virtual Machine Discovery

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Virtual Machine Discovery detections T1673

Virtual Machine Discovery detections T1673