LoFP LoFP / capacity reports, backup troubleshooting, and support scripts list `vmdk` files on a datastore. review the account and whether the search was followed by process kills or snapshot removal.

Techniques

Sample rules

ESXi Virtual Disk Files Enumerated

Description

Detects a shell search under /vmfs/volumes for virtual disk and snapshot files (vmdk, vmsn, vmsd). Those files are the guest disks and their on-host recovery points. Listing them builds the set of files a later process can encrypt or delete.

Detection logic

data_stream.dataset:vsphere.log and message:("/vmfs/volumes" and find and (vmdk or vmsd or vmsn))