ESXi Hypervisor CLI Access via HTTPS

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•10

This rule detects attempts to access the ESXi Hypervisor Command Line Interface (CLI) via HTTPS. It specifically looks for HTTP requests to the '/sdk' and 'vim25' URIs on port 443, which are indicative of vSphere API or CLI interactions with an ESXi host.