ESXi VSAN Information Discovery Via ESXCLI

SigmaHQ Detections@sigmaHQ

•updated May 21, 2025•0•0•0

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.