Skip to content

Catalogue
ATT&CK

Sign in Get started

Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Search detections

Filters

Loading detections…

Loading detections

The public catalogue of detection rules. Every entry carries its source, the identifier it had there, its licence and its ATT&CK mapping.

Product

Catalogue ATT&CK Create a workspace

Trust

Security Privacy Licences Terms

Contact

Report a vulnerability Report a content issue contacto@detections.app

© 2026 Sunturai.

Medium>Splunk security content

ESXi Encryption Settings Modified

Detects the disabling of critical encryption enforcement settings on an ESXi host, such as secure boot or executable verification requirements, which may indicate an attempt to weaken hypervisor integrity or allow unauthorized code execution.

ATT&CK coverage

Defense Impairment

T1685Disable or Modify Tools 278 detections cover this technique

Detection requirements

Log source category: vmware_esxi_syslog

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Sign in to read it Create an account

Provenance

Where this detection came from, and what you may do with it.

At source: Open at source
Written by: Raven Tait
Splunk
Licence: Apache-2.0Read the licence
Published: Aug 26, 2026
Version: 1

See also

2,157 from Splunk security content 3,618 rated medium