Desktop Hypervisor VM Enumeration

Luís Marques@remotecodeexecution

•updated Jul 6, 2026•0•0•2

Detects the execution of known desktop hypervisor management CLI tools such as VBoxManage or vmrun to enumerate local virtual machines. Attackers may use these commands during the discovery phase to identify running virtual environments for evasion or subsequent actions.