ESXi VM Kill Via ESXCLI Command

SigmaHQ Detections@sigmaHQ

•updated May 21, 2025•2•0•44

Detects the execution of the "esxcli" command with the "vm" and "kill" flags, indicating an attempt to terminate or shut down a specific virtual machine on an ESXi hypervisor. This activity can be indicative of malicious actions such as ransomware attacks targeting virtualized environments.