Tag
This brief details the detection of local account creation on VMware ESXi hosts, a technique frequently used by threat actors to establish persistence on hypervisors.