1. A method comprising: establishing messaging channels between a hypervisor of a host machine and a plurality of virtual machines running on the hypervisor of the host machine; communicating with the plurality of virtual machines via the established messaging channels to determine a virtual machine identifier for each of the plurality of virtual machines, wherein a virtual machine identifier of a corresponding virtual machine is determined based on a broadcast message transmitted by the corresponding virtual machine and received by a virtualization monitor, and wherein the virtualization monitor is configured to determine that the corresponding virtual machine is running on the host machine, and to provide the virtual machine identifier of the corresponding virtual machine to the host machine; tracking, by a processing device and in view of virtual machine identifiers of the plurality of virtual machines, a virtual machine identifier transition of the corresponding virtual machine to determine a parent virtual machine identifier of a parent virtual machine of the corresponding virtual machine; determining, based on the parent virtual machine identifier, whether the corresponding virtual machine was previously running on a different hypervisor; and when the corresponding virtual machine was previously running on the different hypervisor, determining whether the different hypervisor that the corresponding virtual machine previously ran on was a compromised or corrupted hypervisor.