« ESXi File Made Executable with chmod ESXi Host Logs Deleted with rm »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

ESXi Firewall Disabled

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ESXi Firewall Disabled

edit

Detects the ESXi firewall being turned off or switched to a default allow. The firewall is the host filter for management services. Disabling it, or setting the default action to accept, lets later connections reach services that were previously blocked.

Rule type: query

Rule indices:

  • logs-vsphere.log-*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Defense Evasion
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating ESXi Firewall Disabled

The ESXi firewall is the host filter for management services. Disabling it, or setting the default action to accept, lets later connections skip that control.

Possible investigation steps

  • Read message to see whether the firewall was disabled or the default action was set to true.
  • Check a later esxcli network firewall get or hostd message showing the firewall enabled again.
  • Correlate with SSH enablement, syslog changes, and VM shutdown commands.

False positive analysis

A short troubleshooting window that turns the firewall off and back on can be benign. A disable that is still in effect, with no ticket, should be treated as hostile.

Response and remediation

  • Re-enable the firewall and set the default action back to DROP: esxcli network firewall set --enabled true --default-action false.
  • Review ruleset changes made in the same session.
  • If the change was unauthorized, isolate the host and rotate credentials.

Setup

edit

Setup

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

Rule query

edit
data_stream.dataset:vsphere.log and message:("Firewall has been disabled" or "network firewall set" and ("--default-action true" or "--default-action=true" or "--enabled false" or "--enabled=false"))

Framework: MITRE ATT&CKTM

« ESXi File Made Executable with chmod ESXi Host Logs Deleted with rm »