LoFP / virtual machine process kills also happen during planned maintenance, host upgrades, and troubleshooting of a stuck vm. confirm the world id, the account, and whether the same session also enumerates `/vmfs/volumes` or removes snapshots.

Techniques

• T1489

Sample rules

ESXi Virtual Machine Process Killed

• source: elastic
• technicques:
  • T1489

Description

Detects termination of a virtual machine process on an ESXi host, including esxcli vm process kill, pkill of vmx processes, and vmdumper suspend. A running VM holds a lock on its disks. Stopping the process releases that lock and makes the disks writable.

Detection logic

data_stream.dataset:vsphere.log and message:("vm process kill" or pkill and vmx or suspend_v and vmdumper)