administrators power off virtual machines for patching, decommissioning, and hardware maintenance. review the account and whether the command targeted one vm id or every id returned by `getallvms`.

t1529
vsphere
elastic

Techniques

T1529

Sample rules

ESXi Virtual Machine Powered Off

source: elastic
technicques:
- T1529

Description

Detects vim-cmd vmsvc/power.off on an ESXi host. Powering a virtual machine off releases the lock the hypervisor holds on its virtual disks. With the guest stopped, those disks can be rewritten or encrypted while the machine is down.

Detection logic

data_stream.dataset: "vsphere.log" and (
  message: "vmsvc/power.off"
)