ESXi VMFS Buffer Modification via esxcfg-advcfg
Detects the use of esxcfg-advcfg to alter the BufferCache settings on an ESXi host. This activity can be a precursor to bulk file encryption, as seen with the 'Gentlemen Linux variant' which modifies VMFS write buffer and flush interval to prepare ESXi hosts for fast, reliable encryption.
Microsoft Sentinel (KQL)
