ESXi Host Shell Enabled via Web API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects attempts to enable the ESXi Host Shell via the vCenter Web API. It specifically looks for HTTP requests to the '/api/vcenter/host' URI containing the word 'shell' in the client body, indicating a potential administrative action to enable shell access on an ESXi host.