{
  "technique_id": "T1673",
  "name": "Virtual Machine Discovery",
  "tactics": [
    "Discovery"
  ],
  "platforms": [
    "ESXi",
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) such as `esxcli` or `vim-cmd` (e.g. `esxcli vm process list or vim-cmd vmsvc/getallvms`). Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host...",
  "generated_by": "SOC Response Atlas by Basyrix"
}