ESXi Firewall Disabled

 1[metadata]
 2creation_date = "2026/09/30"
 3integration = ["vsphere"]
 4maturity = "production"
 5updated_date = "2026/09/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Detects the ESXi firewall being turned off or switched to a default allow. The firewall is the host filter for
11management services. Disabling it, or setting the default action to accept, lets later connections reach services
12that were previously blocked.
13"""
14false_positives = [
15    """
16    Firewall changes are part of some network troubleshooting and product installs. Confirm
17the change was temporary and that `--enabled true` and a DROP default action were restored.
18    """,
19]
20from = "now-9m"
21index = ["logs-vsphere.log-*"]
22language = "kuery"
23license = "Elastic License v2"
24name = "ESXi Firewall Disabled"
25note = """## Triage and analysis
26
27### Investigating ESXi Firewall Disabled
28
29The ESXi firewall is the host filter for management services. Disabling it, or setting the default action to accept, lets later connections skip that control.
30
31#### Possible investigation steps
32
33- Read message to see whether the firewall was disabled or the default action was set to true.
34- Check a later esxcli network firewall get or hostd message showing the firewall enabled again.
35- Correlate with SSH enablement, syslog changes, and VM shutdown commands.
36
37### False positive analysis
38
39A short troubleshooting window that turns the firewall off and back on can be benign. A disable that is still in effect, with no ticket, should be treated as hostile.
40
41### Response and remediation
42
43- Re-enable the firewall and set the default action back to DROP: esxcli network firewall set --enabled true --default-action false.
44- Review ruleset changes made in the same session.
45- If the change was unauthorized, isolate the host and rotate credentials.
46"""
47references = [
48    "https://lolesxi-project.github.io/LOLESXi/#",
49    "https://blogs.vmware.com/security/2022/10/esxi-targeting-ransomware-tactics-and-techniques-part-2.html",
50    "https://detect.fyi/vmware-esxi-logging-detection-opportunities-4fb56411ec21",
51]
52setup = """## Setup
53
54This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere
55"""
56risk_score = 73
57rule_id = "b6900df3-1021-575e-a540-94f3b89687f7"
58severity = "high"
59tags = [
60    "Domain: Endpoint",
61    "Data Source: VMware vSphere",
62    "Use Case: Threat Detection",
63    "Tactic: Defense Evasion",
64    "Resources: Investigation Guide",
65    "Rule Type: Custom Query (KQL)",
66    "Platform: VMware ESXi",
67]
68timestamp_override = "event.ingested"
69type = "query"
70
71query = '''
72data_stream.dataset:vsphere.log and message:("Firewall has been disabled" or "network firewall set" and ("--default-action true" or "--default-action=true" or "--enabled false" or "--enabled=false"))
73'''
74
75[[rule.threat]]
76framework = "MITRE ATT&CK"
77[[rule.threat.technique]]
78id = "T1562"
79name = "Impair Defenses"
80reference = "https://attack.mitre.org/techniques/T1562/"
81[[rule.threat.technique.subtechnique]]
82id = "T1562.004"
83name = "Disable or Modify System Firewall"
84reference = "https://attack.mitre.org/techniques/T1562/004/"
85
86[rule.threat.tactic]
87id = "TA0005"
88name = "Defense Evasion"
89reference = "https://attack.mitre.org/tactics/TA0005/"
90
91[rule.investigation_fields]
92field_names = [
93    "@timestamp",
94    "message",
95    "event.original",
96    "host.hostname",
97    "log.file.path",
98]