ESXi Account Creation via ESXCLI
Detects the creation of a new user account on an ESXi system using the 'esxcli' command-line interface. This activity can be an indicator of an adversary establishing persistence or gaining unauthorized access to the hypervisor.
Sigma
