ESX Admins AD group created or renamed, then populated (CVE-2024-37085 chain)
Detects the creation or renaming of the 'ESX Admins' Active Directory security group combined with the addition of members to it, which is often used for privilege escalation or persistence in VMware ESXi environments managed via Active Directory.
Splunk (SPL)
