ESXi Firewall Disabled by RansomHouse MrAgent

Matt Brady@mbrady5299

•updated Dec 17, 2025•4•1•63

Detects the execution of the ESXi command 'esxcli network firewall set --enabled false' used by the RansomHouse MrAgent deployment tool to disable the host's firewall. This is a defense evasion technique used to ensure C2 communication and subsequent ransomware deployment.