Unexpected VM Creation on Hypervisor via Management Tools or API

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•9

Detects the creation or registration of virtual machines across multiple hypervisor platforms (Hyper-V, VMware ESXi, and VirtualBox) using PowerShell, command-line utilities, or security event logs. The rule alerts on these actions when performed outside of designated business hours or by accounts not included in a pre-defined list of authorized administrators.