ESXi vim-cmd hidden VM registration and snapshot cloning (BrickStorm-style)

Ethan Andrews@eandrews

•updated Aug 13, 2026•2•0•6

Detects ESXi shell execution of vim-cmd commands used to register unregistered/hidden virtual machines or to create and clone VM snapshots, consistent with BrickStorm's technique of establishing hidden rogue VMs on vSphere/ESXi and stealing cloned VM snapshots for credential harvesting.