ESXi Syslog Configuration Change via ESXCLI

SigmaHQ Detections@sigmaHQ

•updated May 21, 2025•1•0•23

Detects changes to the ESXi syslog configuration via the 'esxcli' command-line utility. This activity could indicate an adversary attempting to impair defenses by modifying logging configurations on an ESXi hypervisor.