ESXi Host Direct API Command Execution

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects HTTP POST requests to the '/sdk/vimService' URI on TCP port 443 (HTTPS) targeting an ESXi host. This pattern is indicative of direct API command execution attempts against the VMware vSphere API, which could be used by an attacker to interact with or control the ESXi hypervisor.