Hypervisor VM Creation via Management CLI Tools (Akira Evasion Tactic)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

This rule detects the creation, modification, or startup of virtual machines using common administrative tools such as PowerShell (Hyper-V), vmrun (VMware), VBoxManage (VirtualBox), and vSphere CLI tools. Such activities can be indicators of adversary efforts to create hidden virtual environments, stage malicious payloads, or perform unauthorized administrative actions on virtualized infrastructure.