CmdID

CmdID / PowerShell / Cmdlets / Resume

Resume-VM

Resumes a suspended (paused) virtual machine. Windows Server PowerShell reference

From the Windows Server PowerShell reference 9 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

9 in the Windows Server PowerShell reference
-AsJobRuns the cmdlet as a background job.
-CimSessionRuns the cmdlet in a remote session or on a remote computer.
-ComputerNameSpecifies one or more Hyper-V hosts on which the virtual machine is to be resumed.
-Confirm, -cfPrompts you for confirmation before running the cmdlet.
-CredentialSpecifies one or more user accounts that have permission to perform this action.
-Name, -VMNameSpecifies the name of the virtual machine to be resumed.
-PassthruSpecifies that an object is to be passed through to the pipeline representing the virtual machine to be resumed.
-VMSpecifies an array of virtual machine objects.
-WhatIf, -wiShows what would happen if the cmdlet runs.

What looks for it

Sigma process creation rules that name Resume-VM
highVMToolsd Suspicious Child Processbohops, Bhabesh Raj