Hypervisor VM Creation via ESXi CLI or PowerCLI/Hyper-V Cmdlets for EDR Evasion

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the execution of command-line tools associated with virtual machine management (ESXi CLI, PowerCLI, Hyper-V). The rule monitors for specific process executions (esxcli, vim-cmd, powershell) that involve administrative VM actions such as creating or starting virtual machines, which may indicate malicious VM orchestration, data destruction, or persistence attempts in virtualized environments.