CmdID

CmdID / PowerShell / Cmdlets / Suspend

Suspend-VM

Suspends, or pauses, a virtual machine. Windows Server PowerShell reference

From the Windows Server PowerShell reference 9 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

9 in the Windows Server PowerShell reference
-AsJobRuns the cmdlet as a background job.
-CimSessionRuns the cmdlet in a remote session or on a remote computer.
-ComputerNameSpecifies one or more Hyper-V hosts on which a virtual machine is to be suspended.
-Confirm, -cfPrompts you for confirmation before running the cmdlet.
-CredentialSpecifies one or more user accounts that have permission to perform this action.
-Name, -VMNameSpecifies the name of the virtual machine to be suspended.
-PassthruSpecifies that a Microsoft.HyperV.PowerShell.VirtualMachine object is to be passed through to the pipeline representing the virtual machine to be suspended.
-VMSpecifies the virtual machine to be suspended.
-WhatIf, -wiShows what would happen if the cmdlet runs.

What looks for it

Sigma process creation rules that name Suspend-VM
highVMToolsd Suspicious Child Processbohops, Bhabesh Raj