ESXi Audit Tampering Detection

This detection identifies the use of the `esxcli system auditrecords` commands, which can be used to tamper with logging on an ESXi host. This action may indicate an attempt to evade detection or hinder forensic analysis by preventing the recording of system-level audit events. The rule specifically looks for the use of these commands with 'remote' or 'local' arguments, excluding commands executed within a shell.