Unexpected VM Creation on Hypervisor via Management CLI or PowerShell
Detects execution of virtualization-related tools and PowerShell cmdlets (New-VM, New-VHD) indicative of hypervisor management activities on Windows hosts. The rule monitors for processes such as vmconnect.exe, vmrun.exe, vmware.exe, and vmwp.exe, or specific PowerShell commands, excluding activity initiated by system-level accounts.
Splunk (SPL)
