RansomHouse ESXi Firewall Disablement

Tim Peck@timpeck

•updated Dec 17, 2025•6•0•83

Detects the disabling of the VMware ESXi firewall using 'esxcli', a technique used by the RansomHouse 'MrAgent' tool as a defense evasion tactic before encryption.