Hypervisor VM Creation via vmrun, vim-cmd, PowerCLI or QEMU (EDR Bypass)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the creation or registration of virtual machines using VMware ESXi CLI tools, PowerCLI, or Hyper-V PowerShell cmdlets. This behavior is often associated with adversary attempts to create backdoored VMs, isolate environments, or facilitate lateral movement and persistence within virtualized infrastructure.