vSphere Installation Bundle Uploaded to ESXi Host

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects the upload of a vSphere Installation Bundle (VIB) to an ESXi host. It specifically looks for HTTP PUT requests to the '/bundle' URI with a payload size greater than 100,000 bytes, which is indicative of a VIB file transfer. This activity could be part of a persistence mechanism where an attacker installs malicious software or backdoors on an ESXi host.