ESXi VM List Discovery Via ESXCLI — Detection Rule

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

Read the full analysis on IntelFusions