VMware vSphere VM Inventory Enumerated via API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects attempts to enumerate the VMware vSphere virtual machine inventory via the API. It specifically looks for HTTP POST requests to the '/sdk/vimService' URI with 'RetrieveProperties' in the client body, indicating a query for system properties, which can include VM inventory details. The detection is focused on network traffic to port 443 (HTTPS) within the home network.