ESXi Network Configuration Discovery via ESXCLI

SigmaHQ Detections@sigmaHQ

•updated May 21, 2025•0•32

Detects the execution of the "esxcli" command with the "network" flag to retrieve information about the network configuration on an ESXi host. This activity can be indicative of an adversary performing discovery.