ESXi Virtual Machine Process List

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects `esxcli vm process list` on an ESXi host. The command lists running virtual machines and the world IDs of
11their `vmx` processes. Those IDs are what a later kill command uses to stop the VMs and release the locks on their
12virtual disks.
13"""
14false_positives = [
15    """
16    Administrators list virtual machines during maintenance and troubleshooting. Review whether the same session
17then kills those processes or searches the datastore.
18    """,
19]
20from = "now-9m"
21index = ["logs-vsphere.log-*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "ESXi Virtual Machine Process List"
25note = """## Triage and analysis
26
27### Investigating ESXi Virtual Machine Process List
28
29esxcli vm process list enumerates running virtual machines and their world ids. A later kill command uses those world ids to stop the VMs.
30
31#### Possible investigation steps
32
33- Read message for a plain list versus a list piped into vm process kill.
34- Check the same session for pkill, power.off, snapshot removal, or a search for vmdk files.
35- Confirm with the virtualization owner whether the list was part of a scheduled check.
36
37### False positive analysis
38
39A standalone list during a change window is commonly benign. A list immediately followed by a force kill of every world id is the shutdown step before encryption.
40
41### Response and remediation
42
43- If the same session kills virtual machines or deletes snapshots, isolate the host.
44- Otherwise record the account and source for hunting on other hosts.
45"""
46references = [
47    "https://lolesxi-project.github.io/LOLESXi/#",
48    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
49    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
50]
51setup = """## Setup
52
53This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
54"""
55risk_score = 21
56rule_id = "a7f969e5-6cfd-5b5f-8df4-3c4317a3cf7e"
57severity = "low"
58tags = [
59    "Domain: Endpoint",
60    "Data Source: VMware vSphere",
61    "Use Case: Threat Detection",
62    "Tactic: Discovery",
63    "Resources: Investigation Guide",
64    "Rule Type: Custom Query (KQL)",
65    "Platform: VMware ESXi",
66    "Threat: Ransomware",
67]
68timestamp_override = "event.ingested"
69type = "query"
70
71query = '''
72data_stream.dataset: "vsphere.log" and event.module: "vsphere" and message: ("esxcli" and "vm process list")
73'''
74
75[[rule.threat]]
76framework = "MITRE ATT&CK"
77[[rule.threat.technique]]
78id = "T1057"
79name = "Process Discovery"
80reference = "https://attack.mitre.org/techniques/T1057/"
81
82[rule.threat.tactic]
83id = "TA0007"
84name = "Discovery"
85reference = "https://attack.mitre.org/tactics/TA0007/"
86
87[rule.investigation_fields]
88field_names = [
89    "@timestamp",
90    "message",
91    "event.original",
92    "host.hostname",
93    "log.file.path",
94]