tfMITRE ATT&CK technique

Virtual Machine Discovery T1673

Tactic: Discovery
Platforms: ESXi, Linux, macOS, Windows
Version: 1.0
Created: 27 March 2025
Last modified: 12 May 2026
Contributor: Janantha Marasinghe

An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a Hypervisor CLI such as esxcli or vim-cmd (e.g. esxcli vm process list or vim-cmd vmsvc/getallvms).[1][2] Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Virtual Machine Discovery MITRE reference T1673

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has used scripts to enumerate ESXi hypervisors and their guest VMs.1

created 2025-05-291 reference

All 1 groups for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

PureCrypterS9019 ↗

Can identify virtual machines by querying the WMI object Win32_ComputerSystem for manufacturer and model and check it against the regular expression Microsoft|VMWare|Virtual.1

created 2026-04-16MALWAREcarried by 1 group

QilinS1242 ↗

Can detect virtual machine environments including ESXi hosts, datacenters, and clusters within vCenter environments.1 2

created 2025-09-26MALWAREcarried by 2 groups

VIRTUALPITAS1217 ↗

Can target specific guest virtual machines for script execution.1

created 2025-06-02MALWAREcarried by 1 group

CheerscryptS1096 ↗

Has leveraged esxcli vm process list in order to gather a list of running virtual machines to terminate them.1

created 2023-12-18MALWAREcarried by 1 group

All 4 software entries for this technique

Offense vs defense T1673

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 2

first rule: 2025 Q3

Virtual Machine Discovery detection strategy DET0199

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Virtual Machine Discovery

Enterprise

4 platforms

AN0572 · ESXi

Monitor for execution of hypervisor management commands such as esxcli vm process list or vim-cmd vmsvc/getallvms that enumerate virtual machines. Defenders observe unexpected users issuing VM listing commands outside normal administrative workflows.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	esxi:shell	command IN ("esxcli vm process list", "vim-cmd vmsvc/getallvms")

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExpectedAdminUsers	List of known administrators authorized to run ESXi enumeration commands.
UnexpectedCommandPaths	Defines restricted paths or contexts where VM enumeration should not occur.

AN0573 · Linux

Detects attempts to enumerate VMs via hypervisor tools like virsh, VBoxManage, or qemu-img. Defender correlates suspicious command invocations with parent process lineage and unexpected users.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	auditd:SYSCALL	execve: process_name IN ("virsh", "VBoxManage", "qemu-img") AND command IN ("list", "info")

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
NonRootAccounts	Monitor non-root users invoking hypervisor management utilities.
KnownAdminScripts	Whitelist of scripts expected to run VM enumeration as part of routine operations.

AN0574 · Windows

Detects enumeration of VMs using PowerShell (Get-VM), VMware Workstation (vmrun.exe), or Hyper-V (VBoxManage.exe). Defender observes suspicious command lines executed by unexpected users or outside normal administrative sessions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExpectedAdminAccounts	Defines which accounts are authorized to execute VM discovery commands.
RoutineScripts	Whitelist of approved administrative scripts that legitimately invoke VM enumeration.

AN0575 · macOS

Detects VM enumeration attempts using virtualization utilities such as VirtualBox (VBoxManage) or Parallels CLI. Defender observes abnormal invocation of VM listing commands correlated with non-admin users or unusual parent processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process_name IN ("VBoxManage", "prlctl") AND command CONTAINS ("list", "show")

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Adjust sensitivity depending on whether the command is executed by admin or non-admin users.
ExecutionTimeWindow	Restrict alerts to unusual times when VM management is not expected.

Virtual Machine Discovery detections T1673

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs