1. A method implemented at a datacenter to detect server-side multi-target intrusions, the method comprising: receiving first data related to first one or more occurrences of an administrative event associated with first one or more virtual machines associated with first one or more users, wherein the first one or more occurrences of the administrative event are detected by a first hypervisor; receiving second data related to second one or more occurrences of the administrative event associated with second one or more virtual machines associated with second one or more users, wherein the second one or more occurrences of the administrative event are detected by a second hypervisor; storing the first data and the second data in a database; determining, based at least on the first data and the second data, that a number or frequency of occurrences of the administrative event exceeds a probability threshold; and generating, based on the determination that the number or frequency of the occurrences of the administrative event exceeds the probability threshold, an alert that indicates a possible attack on the datacenter, wherein: determining, based on the first data and the second data, that the number or frequency of occurrences of the administrative event exceeds the probability threshold facilitates cross-deployment or cross-user correlation of the administrative event across multiple deployments or users, generating the alert facilitates prevention of another attack on the datacenter before one of analysis or repair of a vulnerability of the datacenter, and the alert generated based on the determination indicates an alert which represents a higher likelihood of the possible attack on the datacenter when compared to another alert generated in absence of the cross-deployment or cross-correlation of the administrative event.