Detection of Bulk Virtual Machine Termination on VMware ESXi

Monitoring of VMware ESXi infrastructure has identified a significant threat vector involving the mass termination of running virtual machines. Threat actors, including groups associated with Black Basta ransomware, use native ESXi management utilities to force-stop VMs, effectively creating a denial-of-service condition or preparing for data exfiltration and encryption. This activity is characterized by the use of 'pkill' or 'esxcli vm process kill' commands against all hosted instances. Because these commands perform administrative functions that are destructive in nature when applied in bulk, monitoring syslog streams for specific command-line strings allows for high-fidelity detection of post-compromise activity on hypervisors.

Impact

Successful bulk VM termination leads to the immediate loss of availability for all workloads hosted on the affected ESXi server. In ransomware scenarios, this is often a precursor to unauthorized encryption, causing widespread business operational outages, loss of data integrity, and significant recovery costs for impacted organizations.

Recommendation

Detection engineering teams should focus on ingesting VMware ESXi syslog data and applying behavioral analysis to identify unauthorized administrative commands.

• Configure ESXi hosts to forward syslog events to the central SIEM, ensuring the Splunk Technology Add-on for VMware ESXi is utilized for proper CIM-compliant parsing.
• Implement the detection logic below to alert on the execution of 'pkill' and 'esxcli vm process kill' commands that target virtual machine processes.
• Investigate any occurrences of the command-line patterns identified in the analytic to determine if they originate from authorized maintenance scripts or unauthorized actor activity.