ESXi Firewall Disabled

Detects the ESXi firewall being turned off or switched to a default allow. The firewall is the host filter for management services. Disabling it, or setting the default action to accept, lets later connections reach services that were previously blocked.

Rule type: query
Rule indices:

  • logs-vsphere.log-*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • Data Source: VMware vSphere
  • Use Case: Threat Detection
  • Tactic: Defense Evasion
  • Resources: Investigation Guide
  • Rule Type: Custom Query (KQL)
  • Platform: VMware ESXi

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires ESXi host logs collected by the Elastic vSphere integration: https://www.elastic.co/docs/reference/integrations/vsphere

The ESXi firewall is the host filter for management services. Disabling it, or setting the default action to accept, lets later connections skip that control.

  • Read message to see whether the firewall was disabled or the default action was set to true.
  • Check a later esxcli network firewall get or hostd message showing the firewall enabled again.
  • Correlate with SSH enablement, syslog changes, and VM shutdown commands.

A short troubleshooting window that turns the firewall off and back on can be benign. A disable that is still in effect, with no ticket, should be treated as hostile.

  • Re-enable the firewall and set the default action back to DROP: esxcli network firewall set --enabled true --default-action false.
  • Review ruleset changes made in the same session.
  • If the change was unauthorized, isolate the host and rotate credentials.
data_stream.dataset:vsphere.log and message:("Firewall has been disabled" or "network firewall set" and ("--default-action true" or "--default-action=true" or "--enabled false" or "--enabled=false"))

Framework: MITRE ATT&CK