ESXi Virtual Machine Snapshot Removed

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects removal of all snapshots for an ESXi virtual machine. Snapshots are on-host recovery points for a guest.
11Removing all of them deletes those recovery points, so the virtual machine cannot be reverted to an earlier disk
12state.
13"""
14false_positives = [
15    """
16    Snapshot consolidation after backups, storage pressure, and planned decommissioning can
17remove every snapshot for a VM. Confirm the account and whether the command ran against one VM or every VM.
18    """,
19]
20from = "now-9m"
21index = ["logs-vsphere.log-*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "ESXi Virtual Machine Snapshot Removed"
25note = """## Triage and analysis
26
27### Investigating ESXi Virtual Machine Snapshot Removed
28
29Snapshots are the local recovery point on a datastore. snapshot.removeall deletes them for one VM id. Ransomware wraps that command in a loop over every VM.
30
31#### Possible investigation steps
32
33- Read the VM id in message. A loop that calls removeall for every id from getallvms is higher severity than one VM.
34- Check whether VM processes were killed or disks were enumerated in the same session.
35- Ask the backup or virtualization owner whether snapshot consolidation was underway.
36
37### False positive analysis
38
39Backup products and administrators delete snapshots after a successful consolidate. Match the account and the change ticket before closing the alert.
40
41### Response and remediation
42
43- If removal was not approved, isolate the host and stop the shell session.
44- Restore affected VMs from an off-host backup. Datastore snapshots removed by this command are gone.
45- Preserve shell history and hostd logs.
46"""
47references = [
48    "https://lolesxi-project.github.io/LOLESXi/#",
49    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
50    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
51]
52setup = """## Setup
53
54This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
55"""
56risk_score = 73
57rule_id = "e822bf97-933f-58f9-bd14-47a2ac9cd5d3"
58severity = "high"
59tags = [
60    "Domain: Endpoint",
61    "Data Source: VMware vSphere",
62    "Use Case: Threat Detection",
63    "Tactic: Impact",
64    "Resources: Investigation Guide",
65    "Rule Type: Custom Query (KQL)",
66    "Platform: VMware ESXi",
67    "Threat: Ransomware",
68]
69timestamp_override = "event.ingested"
70type = "query"
71
72query = '''
73data_stream.dataset: "vsphere.log" and (
74  message: "snapshot.removeall"
75)
76'''
77
78[[rule.threat]]
79framework = "MITRE ATT&CK"
80[[rule.threat.technique]]
81id = "T1490"
82name = "Inhibit System Recovery"
83reference = "https://attack.mitre.org/techniques/T1490/"
84
85[rule.threat.tactic]
86id = "TA0040"
87name = "Impact"
88reference = "https://attack.mitre.org/tactics/TA0040/"
89
90[rule.investigation_fields]
91field_names = [
92    "@timestamp",
93    "message",
94    "event.original",
95    "host.hostname",
96    "log.file.path",
97]