ESXi System Information Discovery Via ESXCLI

SigmaHQ Detections@sigmaHQ

•updated May 21, 2025•0•30

Detects the execution of the 'esxcli' command with the 'system' flag, combined with 'get' or 'list' subcommands, to retrieve information about various system components on an ESXi host. This can include details about accounts, modules, NTP settings, and other system configurations.