ESXi Virtual Machine Powered Off

Last updated 2 days ago on 2026-09-30

Created 2 days ago on 2026-09-30

About

Detects `vim-cmd vmsvc/power.off` on an ESXi host. Powering a virtual machine off releases the lock the hypervisor holds on its virtual disks. With the guest stopped, those disks can be rewritten or encrypted while the machine is down.

Tags

Domain: EndpointData Source: VMware vSphereUse Case: Threat DetectionTactic: ImpactRule Type: Custom Query (KQL)Platform: VMware ESXiThreat: RansomwareLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Impact (TA0040)(external, opens in a new tab or window)

↳ System Shutdown/Reboot (T1529)(external, opens in a new tab or window)

False Positive Examples

Administrators power off virtual machines for patching, decommissioning, and hardware maintenance. Review the account and whether the command targeted one VM id or every id returned by `getallvms`.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-vsphere.log-*
Related Integrations: vsphere(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "vsphere.log" and (
  message: "vmsvc/power.off"
)

Install detection rules in Elastic Security

Detect ESXi Virtual Machine Powered Off in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).