Creation of "ESX Admins" Group for ESXi Privilege Escalation
Detects the creation of the Active Directory group "ESX Admins". Threat actors create this group to exploit CVE-2024-37085, which grants any member of this group administrative privileges on domain-joined VMware ESXi hypervisors.
Microsoft Sentinel (KQL)
