Detects when ESXi ExecInstalledOnly protection is disabled. ExecInstalledOnly restricts execution to binaries installed by a VIB and unmodified. When turned off, the host can execute files from non-system paths (such as /tmp), enabling potential payloads or unsigned binaries. The rule triggers on vsphere logs that mention execInstalledOnly being set to FALSE or commands like -i 0 or -v 0. It maps to MITRE ATT&CK Defense Evasion (T1562.001: Disable or Modify Tools). Includes triage guidance, investigation steps, false positives considerations, and remediation recommendations to re-enable the setting and audit VIB changes.