ESXi Syslog Configuration Change via esxcli
This detection identifies changes to the syslog configuration on an ESXi host using `esxcli`, which may indicate an attempt to disrupt log collection and evade detection. Adversaries may modify logging configurations to hinder forensic analysis and remain undetected.
Splunk (SPL)
