Linux Process Creation: ESXi esxcli VM kill via vm process kill flags
Triggers when esxcli is executed with VM process kill arguments, indicating a potential ESXi VM termination.
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon (SigmaHQ), DRL 1.1
- Published
- 2023-09-04
- Updated
- 2026-07-31
ATT&CK techniques
Execution → ImpactRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies execution of the esxcli binary where the command line includes the specific VM management sequence "vm process" and the "kill" flag. Attackers may use this to force-stop or disrupt a target virtual machine on an ESXi host during impact activities. It relies on process creation telemetry from Linux that captures the executed image path and the full command line.
Reporting behind it
- crowdstrike.comhttps://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
- developer.broadcom.comhttps://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html
- secuinfra.comhttps://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/
- trendmicro.comhttps://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux Process Creation: ESXi esxcli VM kill via vm process kill flags"
id: 0491e5fc-7166-4a7d-8bc1-51372026c8b4
status: test
description: This rule identifies execution of the esxcli binary where the command line includes the specific VM management sequence "vm process" and the "kill" flag. Attackers may use this to force-stop or disrupt a target virtual machine on an ESXi host during impact activities. It relies on process creation telemetry from Linux that captures the executed image path and the full command line.
references:
- https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/
- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html
- https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/
- https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml
author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon, Huntrule Team
date: 2023-09-04
tags:
- attack.execution
- attack.impact
- attack.t1059.012
- attack.t1529
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /esxcli
CommandLine|contains|all:
- vm process
- kill
condition: selection
falsepositives:
- Legitimate administration activities
level: medium
license: DRL-1.1
related:
- id: 2992ac4d-31e9-4325-99f2-b18a73221bb2
type: derived