ESXi Encryption Settings Modified
Detects the disabling of critical encryption enforcement settings on an ESXi host, such as secure boot or executable verification requirements, which may indicate an attempt to weaken hypervisor integrity or allow unauthorized code execution. This rule specifically looks for syslog messages indicating modifications to encryption settings, including parameters like `--require-secure-boot` or `require-exec-installed-only`.
Splunk (SPL)
