ESXi Virtual Machine Process Killed

Detects termination of a virtual machine process on an ESXi host, including esxcli vm process kill, pkill of vmx processes, and vmdumper suspend. A running VM holds a lock on its disks. Stopping the process releases that lock and makes the disks writable.

Rule type: query
Rule indices:

  • logs-vsphere.log-*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Impact
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi
  • Threat: Ransomware

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Stopping vmx releases the lock on a virtual disk. ESXi ransomware does this immediately before it encrypts files under /vmfs/volumes.

  • Read the full command in message and event.original. Note --type (soft, hard, force), --world-id / -w, and whether the line is an awk loop over vm process list.
  • Identify the account and source from the same host in /var/log/shell.log and /var/log/auth.log around @timestamp.
  • Check whether the same session listed VMs, searched for *.vmdk, removed snapshots, or reset the syslog loghost.
  • Confirm with the VM owner whether that world id was shut down on purpose.

Maintenance and crash recovery use the same esxcli kill types. A single soft shutdown of a named VM during a change window is often expected. A loop that kills every world id is not.

  • If the kill was not approved, isolate the host from the management network and stop further shell activity.
  • Leave powered-on VMs running. Shutting them down releases disk locks and lets encryption continue.
  • Preserve shell.log, hostd.log, and auth.log, and restore any VM that was stopped from a known-good backup.
data_stream.dataset:vsphere.log and message:("vm process kill" or pkill and vmx or suspend_v and vmdumper)

Framework: MITRE ATT&CK