ESXi Virtual Machine Powered Off

Detects vim-cmd vmsvc/power.off on an ESXi host. Powering a virtual machine off releases the lock the hypervisor holds on its virtual disks. With the guest stopped, those disks can be rewritten or encrypted while the machine is down.

Rule type: query
Rule indices:

  • logs-vsphere.log-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Impact
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi
  • Threat: Ransomware

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

vim-cmd vmsvc/power.off is the guest-aware shutdown path ransomware uses when esxcli vm process kill is not enough. A for loop over getallvms powers off every guest on the host.

  • Read message for a single VM id versus a loop over vim-cmd vmsvc/getallvms.
  • Correlate with snapshot removal, vm process kill, and find commands for *.vmdk on the same host.
  • Ask the VM owner whether that power-off was scheduled.

One VM powered off by a known administrator during a change window is commonly benign. Powering off every VM in one shell loop is the ransomware pattern.

  • If the power-off was not approved, isolate the host and do not reboot it.
  • Power guests back on only after confirming their disks were not encrypted, or restore them from backup.
  • Preserve shell and hostd logs for the session that issued power.off.
data_stream.dataset: "vsphere.log" and (
  message: "vmsvc/power.off"
)

Framework: MITRE ATT&CK