T1673 Virtual Machine Discovery

Enterprise

An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a Hypervisor CLI such as `esxcli` or `vim-cmd` (e.g. `esxcli vm process list or vim-cmd vmsvc/getallvms`). Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host. Adversaries may use the information from Virtual Machine Discovery during discovery to shape follow-on behaviors. Subsequently discovered VMs may be leveraged for follow-on activities such as Service Stop or Data Encrypted for Impact.

01

platforms

Platforms this applies to.

ESXiLinuxmacOSWindows
02

tactics

ATT&CK tactics this technique serves.

03

detected by (2)

Data components that detect this.

04

groups (1)

Threat groups associated with this.

05

software (5)

Malware and tools associated with this.

06

source

Where this definition is published.

MITRE ATT&CK