ESXi VM List Discovery Via ESXCLI

SigmaHQ Detections@sigmaHQ

•updated May 21, 2025•0•37

Detects the execution of the 'esxcli' command with the 'vm' flag to retrieve information about installed virtual machines on an ESXi hypervisor. This activity can be part of discovery phase by adversaries targeting ESXi environments.