ESXi System Clock Manipulation

This detection identifies a significant change to the system clock on an ESXi host, which may indicate an attempt to manipulate timestamps and evade detection or forensic analysis. The rule parses syslog messages from ESXi to extract the stepped time, the delta of the change, and the direction (forward or backward).