Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1673

Virtual Machine Discovery

Discovery 4 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Entra ID Sign-in BloodHound Suite User-Agent Detected production 2026-09-18
elastic Entra ID Sign-in TeamFiltration User-Agent Detected production 2026-09-18
splunk ESXi Bulk VM Termination production 2026-09-08
splunk ESXi VM Discovery production 2026-05-13