ESXi Direct SSH Shell Access Attempt

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects an attempt to access the ESXi direct SSH shell by looking for the 'vim-cmd' string in TCP traffic directed to port 22 (SSH) on the home network. This indicates an administrative command being executed directly on an ESXi host via SSH.