ESXi Admin Permission Assigned To Account Via ESXCLI — Detection Rule

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

Read the full analysis on IntelFusions