ESXi VMFS Buffer Modification
Detects the use of esxcfg-advcfg to alter the BufferCache settings (MaxCapacity or FlushInterval) on an ESXi host. This activity is often associated with ransomware variants like Gentlemen ransomware, which modify these settings to prepare the storage layer for fast, reliable bulk file encryption.
CQL
