ESXi Account Creation Via ESXCLI (b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db)

Detects user account creation on ESXi system via esxcli

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
ESXi Account Creation Via ESXCLI (b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db)	Sigma-Rules	Hypervisor CLI - T1059.012 (d2d642da-61ff-4211-b4df-7923c9ca220c)	Attack Pattern	1
ESXi Account Creation Via ESXCLI (b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db)	Sigma-Rules	Create Account - T1136 (e01be9c5-e763-4caf-aeb7-000b416aef67)	Attack Pattern	1
Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	Hypervisor CLI - T1059.012 (d2d642da-61ff-4211-b4df-7923c9ca220c)	Attack Pattern	2