LoFP / firewall changes are part of some network troubleshooting and product installs. confirm the change was temporary and that `--enabled true` and a drop default action were restored.

Techniques

• T1562

Sample rules

ESXi Firewall Disabled

• source: elastic
• technicques:
  • T1562

Description

Detects the ESXi firewall being turned off or switched to a default allow. The firewall is the host filter for management services. Disabling it, or setting the default action to accept, lets later connections reach services that were previously blocked.

Detection logic

data_stream.dataset:vsphere.log and message:("Firewall has been disabled" or "network firewall set" and ("--default-action true" or "--default-action=true" or "--enabled false" or "--enabled=false"))